Law 21.719 was published in December 2024 and replaces Chile's 1999 personal data law. It gave companies two years to get ready, so the original start date is December 1, 2026.
The date is moving
In late October 2026 the Senate approved a bill that moves the start to October 15, 2027. The Executive had proposed December 1, 2027, and the Senate brought it forward. The bill also raises the council of the new Personal Data Protection Agency from three to five members.
The Chamber of Deputies still has to approve it and it has to be published. Until then the legal date is still December 1, 2026. I would not wait to see how it ends: the work on a website is the same with either date.
What the law asks, in plain terms
- Have a valid reason (a legal basis) for each way you use a person's data.
- Tell people what you collect, why, and who you share it with.
- Answer on time when someone asks to see, correct or delete their data.
- Protect the data with security measures and report breaches.
- Assess impact before high risk processing and take care with transfers abroad.
The Agency will be able to investigate on its own. Fines reach 5,000 UTM for minor breaches, 10,000 for serious ones and 20,000 for very serious ones.
Where this shows up on a website
Almost every site collects personal data, even when it does not look like it: the contact form, a contest sign up, the Meta pixel, Google Analytics, the chat widget. Each of those needs a notice, consent where it applies and a clear destination for the data.
The first thing I do in these cases is an inventory: what the site collects, where it is stored and who sees it. With that, your legal advisor can write the privacy policy, and I implement the cookie banner, the consent checkboxes and a record of each one.
This is the technical part your site will need either way. The legal side is for your advisor.
