1. Data decentralization vs. legal accountability

A Data Mesh architecture decentralizes data ownership to autonomous domain teams. Under Chile Law 21.719, however, the legal entity acts as a single data controller before the Data Protection Agency. Domain autonomy never eliminates the requirement for unified Records of Processing Activities (ROPA).

2. Purpose limitation principle across federated domains

Article 12 mandates that data processing remain strictly confined to authorized purposes. In a data mesh, Data Contracts must enforce legal purpose metadata and consent validity checks before enabling cross-domain consumption in federated data products.

3. Access policies and minimization as code

Implementing data minimization (Article 3) requires automated dynamic data masking and tokenization policies implemented at the data serving layer. Domain products must expose de-identified analytical datasets by default.

4. Tamper-evident data lineage for regulatory oversight

The Agency holds the power to inspect the full lifecycle of personal data. Every ingestion, transformation, and federated transfer must produce immutable lineage metadata to substantiate processing legality during supervisory audits.