How do you comply with Chile's Law 21.719?

In 30 seconds

• Law 21.719 is set to take effect on December 1, 2026, and getting ready takes time: each step depends on the one before.
• Start by knowing what data you process and on what basis; then organise it and get ready to respond.
• Two deadlines are worth knowing: 30 calendar days (extendable once) for most requests and just 2 business days for temporary blocking.

Compliance isn't an event, it's a task list

Chile's Law 21.719 is set to take effect on December 1, 2026. A bill in Congress could postpone it to 2027, but it isn't law yet, and either way the underlying obligation is coming.

Getting ready takes time, and most steps depend on the previous one already being in place. This checklist turns the law into seven practical actions to get started, in the order it makes sense to tackle them:

It isn't the full list of what the law requires, but the most useful starting point for an SME.

1. Map what data you process

Before writing any policy, you need to know what personal data your company collects, from whom, for what and where it's stored: web forms, customer database, payroll, marketing tools.

The law doesn't require a record of processing activities like the GDPR's. But it does require you to publish information about what data you process and why, and to be able to show you comply. Without this inventory, you can do neither.

2. Identify the lawful basis for each processing activity

Every processing activity needs a basis that justifies it. Consent is one, but not the only one: performing a contract or a legal obligation are others.

What matters is that you've identified and documented the basis for each. If it's consent, it should be clear and people should genuinely be able to say no.

3. Publish a clear privacy policy

It should explain in plain language what data you collect, what you use it for and what rights people have. It has to be visible on your website, not buried in a PDF nobody finds. And give it a date and version: the law asks that it be clear which one is current.

4. Apply security measures and data protection by design

The law asks you to protect data with measures proportionate to what you process, and to think about privacy from the moment you design a form, a tool or a process: collect only what you need.

5. Sign contracts with the vendors that process data on your behalf

If a company processes data for you (your email, payroll or hosting provider), you need a contract that sets what it can do with it and that it deletes or returns the data when the service ends. And if that data leaves Chile, check that the transfer is legally covered.

6. Open a channel for people to exercise their rights

Anyone can ask to access their data, correct it, erase it, object to its processing, take it to another provider or temporarily block it. You need a clear channel (an email address or a form) and a process to answer on time:

Blocking is the deadline that surprises people most: with only two business days, a request left sitting in a shared inbox is already late. And until you answer, you can't use that data.

7. Write a breach protocol

If an incident poses a reasonable risk to the people whose data you process, you have to notify the Agency without undue delay and by the fastest means available. There's no fixed deadline in hours, so there's no room to improvise.

Also, if the breach involves sensitive data, data about children under 14 or data about debts or economic, financial or commercial obligations, you have to notify each affected person too. The protocol (who decides, who notifies, what gets documented) has to be written before it happens.

And keep a record of every incident you report (what happened, what data, how many people it affected and what you did): the law requires it.

From the list to a system

These seven actions are the starting point. Keeping them alive (evidence up to date, periodic reviews, an inventory that doesn't go stale in six months) is where most SMEs lose the thread when they manage it in loose documents.

For the law in detail (effective date, sanctions, data protection officer and prevention model) read our Law 21.719 guide. And if your company already complies with the GDPR, see what you're missing for the Chilean law.

Would you rather organise this on a system than in a folder of documents? Talk to us and we'll go through it together.

Frequently asked questions

01Where do I start with Law 21.719?

By knowing what personal data you process: whose, for what, on what basis and where it's stored. Without that inventory you can't organise or prove anything else.

02Is a record of processing activities mandatory?

Not as a general obligation. Inventorying the data you process is one of the elements of the infringement prevention model, which is voluntary. Even so, without that inventory you can't meet the transparency duty or show that you comply.

03Do I need a data protection officer?

It isn't mandatory for every organisation. The officer is part of the infringement prevention model, which is voluntary and, if certified, mitigates sanctions. In an SME, the owner or senior management can take on those duties themselves. If you're unsure about your case, confirm with legal counsel.