1. Introduction to the new standard

Law 21.719 radically transforms personal data regulation in Chile, introducing the Data Protection Agency and fines of up to 20,000 UTM. Generic terms and conditions are no longer enough; compliance must be embedded into the technical architecture.

2. Scope and lawful basis

Every processing operation on individuals in Chile requires a demonstrable lawful basis: prior, express and informed consent, contract execution, or balanced legitimate interest. This demands mapping databases and justifying every data collection flow.

3. Implementation timelines & enforcement

Following enactment and entry into force, companies have a transition period to adapt legacy systems, consent capture models, and data subject request response workflows.

4. Governance & continuous audit

The accountability principle demands maintaining records of processing activities (ROPA), data protection impact assessments (DPIA) for high-risk processing, and tamper-evident technical audit trails for sensitive data access.

5. Operational go-live checklist

Verify before go-live: granular consent banners without pre-checked boxes, ARCOPB subject rights channels with sub-30 business day SLA, DPAs with sub-processors (AWS, GCP, SaaS), and 72-hour breach notification runbooks.