Your company under Chile's Law 21.719

When it takes effect

The law was published in December 2024 and its entry into force was set for 1 December 2026. In September 2026 the government submitted a bill to the Senate proposing a one-year delay, to December 2027, alongside changes to how the Data Protection Agency is set up (Bulletin 18623-07).

Until that bill passes, the operative date remains December 2026. Plan for that date and treat any delay as slack, not as permission to wait.

What changes from the old regime

The substantive change is that a regulator with teeth appears, along with concrete documentation duties for whoever processes data.

• A Data Protection Agency with supervisory and sanctioning powers.
• Rights of access, rectification, erasure, objection and portability.
• A duty to report security breaches within tight deadlines.
• A record of processing activities with a documented legal basis.
• A data protection officer when processing is significant.
• Fines up to 20,000 UTM; during the first year, SMEs receive warnings before fines.

What a small company can do without a lawyer

Before hiring advice there is work only the people who know the operation can do: figuring out what personal data the company holds and where it lives.

• Inventory where personal data lives: CRM, spreadsheets, email, backups, third-party tools.
• Write down what each dataset is used for and on what grounds.
• Review who has access and revoke the inherited permissions nobody uses.
• Define how long each thing is kept and when it gets deleted.
• List every provider that touches that data, AI services included.
• Write the procedure for answering a data request and for reporting a breach.

Where artificial intelligence comes in

Calling a model through an API doesn't make your provider the owner of your data, but it does oblige you to know what leaves the company. Check whether the contract excludes your content from training, where the processing happens and how long anything is retained.

The most effective control comes earlier: minimize. If the model can do the job with an internal identifier instead of the name and national ID, there is no reason to send it the identity. The table linking the two stays in your database.

How we handle it in a project

In every implementation we document which data is processed, for what purpose, where it is stored, how long it is kept and which providers are involved. That document is exactly the input a legal team needs for the record of processing activities.

We don't do legal interpretation: we implement the technical controls and work with whatever your lawyer or data protection officer defines. If your case requires that information never leaves the company, that gets designed in from the start rather than patched at the end.