BBP strengthens its Personal Data Protection advisory services ahead of the entry into force of Law No. 21.719

Santiago, April 2026

On December 1, 2026, Law No. 21.719 will enter into force, amending the regulation of personal data processing in Chile, repealing Law No. 19.628, and introducing a new general regulatory framework applicable to any natural or legal person, whether public or private, that carries out personal data processing operations in the course of its activities.

Key obligations established by the new legislation

The law imposes on organizations a duty of proactive compliance known as the accountability principle: it is not sufficient to merely refrain from violating the law — organizations must be able to demonstrate, at any time, that their internal processes comply with the standards required by law. This entails having implemented privacy policies, records of processing activities, operational mechanisms to handle data subject requests, and documented procedures for responding to security incidents.

To oversee compliance with these obligations, the law establishes the Personal Data Protection Agency, an autonomous body vested with broad powers of investigation, inspection, and enforcement. Serious violations of the regulation may be subject to fines of up to 20,000 UTM, equivalent to approximately CLP $1,180,000,000 at current value, without prejudice to any civil liability arising from the unlawful processing of personal data.

Regulatory compliance requires advance planning

Effective compliance with the obligations imposed by the law requires organizations to implement, prior to its entry into force, internal data governance structures, adequate agreements with vendors and processors acting as data processors, and operational protocols aligned with the standards of the new regulation. This process requires time and specialized legal counsel. Organizations that do not begin their compliance process with sufficient lead time will be exposed to administrative sanctions, civil liability, and reputational harm from the first day the law takes effect.

BBP: comprehensive personal data protection and compliance advisory services

Beuchat, Barros & Pfenniger has a well-established track record in intellectual property and technology law, enabling it to provide clients with comprehensive advisory services in personal data protection and regulatory compliance. BBP’s Data Protection team accompanies clients at every stage of the compliance process: from the initial data processing assessment and the design and implementation of internal protocols, to contractual review with vendors and processors, team training, and ongoing advisory support under the requirements of Law No. 21.719 — all in keeping with the standard of excellence that has defined the firm since 1964.

For further information, please contact our team at bbp@bbp.cl or by phone at +56 2 2599 6500.