Regulationsby GlyphChile Personal Data Protection Law (Ley 21.719)
Enacted Chile · In force Dec 1, 2026 · next deadline Dec 1, 2026 (in 35 days)
Deadlines
Coming up
Law in forceMain obligations apply and the Personal Data Protection Agency begins supervision.
Proposed postponement of entry into forceGovernment bill Boletin 18623-07 (filed 1 Sep 2026, 'suma' urgency) would replace the 24-month vacatio legis in transitional Art 1 with a fixed date of 1 Dec 2027; in first committee stage in the Senate, not law.
Already passed
Published in Diario OficialLaw 21.719 published; 24-month vacatio legis begins.
Summaries for reference, not legal advice. Check the official text.
What it does
Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.
- Who it applies to
- Controllers and processors established in Chile, and those outside Chile offering goods/services to or monitoring individuals in Chile. No size threshold (graduated fines for small businesses).
- Penalties
- Fines up to 5,000 UTM (minor), 10,000 UTM (serious) and 20,000 UTM (very serious) infringements; repeat serious/very serious infringements by larger companies can reach a percentage of annual revenue (up to 4%) per secondary sources.
- Enforced by
- Agencia de Protección de Datos Personales
- Official name
- Ley Nº 21.719 que regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos Personales
- Citation
- Ley Nº 21.719 (Diario Oficial 13 Dec 2024)
- Topics
- Privacy, Breach notification
Research notes
Fact-check 2026-09-22 against BCN LeyChile metadata: promulgated 25 Nov 2024 ('Santiago, 25 de noviembre de 2024'), published in the Diario Oficial 13 Dec 2024, deferred entry into force 1 Dec 2026 (first day of the 24th month after publication, transitional Art 1). Pending amendment: government bill Boletin 18623-07 (filed 1 Sep 2026 with 'suma' urgency, Senate Constitution Committee first report stage) would postpone entry into force to 1 Dec 2027 and require the Agency's first board appointments at least 12 months before; a separate member's bill 18060-07 (Jan 2026) is also in committee. Until enacted, 1 Dec 2026 remains the legal date.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setCanada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date setMexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025
Questions about Chile Personal Data Protection Law (Ley 21.719)
- What are the Chile Personal Data Protection Law (Ley 21.719) compliance deadlines?
- Dec 13, 2024: Published in Diario Oficial. Dec 1, 2026: Law in force. Dec 1, 2027: Proposed postponement of entry into force (tentative).
- When does Chile Personal Data Protection Law (Ley 21.719) take effect?
- Chile Personal Data Protection Law (Ley 21.719) takes effect on Dec 1, 2026. The next milestone is Dec 1, 2026: Law in force.
- Who does Chile Personal Data Protection Law (Ley 21.719) apply to?
- Controllers and processors established in Chile, and those outside Chile offering goods/services to or monitoring individuals in Chile. No size threshold (graduated fines for small businesses).
- What are the penalties under Chile Personal Data Protection Law (Ley 21.719)?
- Fines up to 5,000 UTM (minor), 10,000 UTM (serious) and 20,000 UTM (very serious) infringements; repeat serious/very serious infringements by larger companies can reach a percentage of annual revenue (up to 4%) per secondary sources.