What changed
2026-10-17 12:39 UTC → 2026-10-27 11:42 UTC ·
added
removed
Chile is currently debating The Chilean government has formally submitted a potential one-year postponement bill to the Senate proposing to postpone the implementation of Law No. 21.719, the new Personal Data Protection Law, which is scheduled to take effect on 21.719 from December 1, 2026. The government 2026 to late 2027. A recent Senate Constitution Commission approval has proposed adjusted this delay to allow for the establishment of proposed timeline, setting a functional new target enforcement date of October 15, 2027. To ensure the Data Protection Agency (APDP), as (APDP) is properly established, the Senate recently rejected legislative modifications seek to expand the government’s proposed candidates for its council. The lack Agency’s Board of an operational regulatory agency Directors from three to five members, all of whom must have exclusive dedication to their roles. The Senate has created legal uncertainty maintained a high bar for businesses and public services, particularly regarding these appointments, rejecting a proposal to lower the management required approval quorum from two-thirds to four-sevenths. Under the current plan, the President will propose five individuals with staggered terms of sensitive information like biometric data six, four, and facial recognition. Non-compliance under two years, requiring a single-unit approval by the new framework could result in significant economic sanctions, Senate with fines ranging from approximately $358 million a two-thirds majority. This delay aims to $1.4 billion CLP, and potentially reaching 4% address organizational unreadiness; a University of Chile survey indicated that only 29.11% of surveyed organizations possess a company’s annual revenue for repeat offenders. Despite the debate clear data protection strategy, while over 54% do not perform impact assessments. Experts advise that organizations use this extended period to improve internal governance, conduct data diagnostics, and integrate data protection with cybersecurity capabilities. Despite the shifting timeline, the law’s core principles—including “data protection by design,” legitimacy, and accountability—remain central to the transition. The framework establishes for compliance. The law continues to establish rights regarding access, rectification, suppression, opposition, and portability of personal information. This legislative movement follows Chile’s 2021 constitutional inclusion of neuro-rights to protect physical and mental integrity. Compliance requirements continue to scale with organizational size. While large corporations must manage complex systems, small and medium-sized enterprises (SMEs) may receive written warnings instead of fines during the first 12 months of the law’s validity, though these warnings will be officially recorded.