Chile's Law 21.719, published on 13 December 2024, rewrites the country's data protection rules and creates an independent Personal Data Protection Agency. It is due to take effect on 1 December 2026. Six weeks before that date, there is uncertainty: the government has asked Congress to postpone it by one year.
The Legal Position Today
Until a postponement law is published in the Official Gazette, the start date remains 1 December 2026. From then, companies will face GDPR-style obligations — new data subject rights, a duty to report security breaches, stricter rules on international transfers and fines of up to 20,000 UTM for the most serious infringements, with higher amounts possible for large companies and repeat offenders.
The Postponement Bill
On 1 September 2026 the government submitted a bill to the Senate (Bulletin No. 18.623-07) that would:
- move the start date from 1 December 2026 to 1 December 2027;
- increase the Agency's Board of Directors from three to five members, with partial renewal every two years; and
- adjust the procedure for appointing the first board members.
The background is the Agency's leadership: in May 2026 the Senate rejected the proposed candidates for the board. At the start of October 2026 the bill was still in its first reading in the Senate's Constitution Committee, with urgency. Some senators have argued that a full year is too long and proposed a shorter delay of around six months, or applying certain provisions earlier.
In short: the outcome is open. Companies should plan for 1 December 2026 and treat any postponement as extra time, not as a reason to pause.
Decree 662: Infringement Prevention Models
On 9 September 2026 the regulation on infringement prevention models (modelos de prevención de infracciones) was published in the Official Gazette as Decree No. 662. It sets out:
- the elements of a voluntary data protection compliance programme;
- the functions and requirements of the data protection officer within that programme; and
- the certification, registration and supervision of such programmes by the Agency.
Adopting a certified model is voluntary, but under Law 21.719 it counts as a mitigating factor when the Agency imposes sanctions. It does not replace the general duty to comply.
What to Do Now
- Build your records of processing and identify your legal bases
- Set up processes for data subject rights and breach notification
- Appoint a data protection lead or DPO and consider a prevention model under Decree 662
- Review international transfers and vendor contracts
- Follow the Senate debate on Bulletin 18.623-07
Our guide to Law 21.719 explains the obligations in detail.
How ResGuard Can Help
The ResGuard Data Protection Manager gives you records of processing, rights requests, DPIAs and breach management in Spanish, and our outsourced DPO service for Chile supports you in preparing for Law 21.719.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: Law 21.719, Bulletin No. 18.623-07, Decree No. 662 published in the Official Gazette on 9 September 2026, and published legal commentary.