Chile's new personal data law, Law 21,719, would not take effect on December 1, 2026 as planned but on October 15, 2027: the Senate approved the postponement on October 28 by 33 votes to 6, according to Emol, and on November 5 the Chamber of Deputies' Constitution Committee approved it in general unanimously, according to NIVEL4. The bill (Bulletin 18,623-07) carries an immediate-discussion urgency and must now go through the Finance Committee and the Chamber floor.
There is a hard deadline: if the postponement is not approved and published in the Official Gazette before December 1, the law takes effect that day on its original schedule. This article explains what the personal data law changes for people, why the government asked for more time, who opposes it and what could happen in the next three weeks.
View the data as a table
| Organizations that did not feel ready | 72% |
| Had not applied any measure | 45.7% |
| Months of postponement | 10.5 |
| Maximum fine under the law | 20,000 UTM |
What Chile's personal data law is and what rights it gives you
Law 21,719 was published on December 13, 2024 and replaces much of Law 19,628 of 1999, which regulated personal data without an authority to enforce it. The new law creates the Personal Data Protection Agency, an autonomous body that will be able to issue instructions, inspect, sanction and resolve people's complaints, according to Garrigues.
For anyone, the main change is clearer rights over their data and an authority to complain to. The law strengthens the rights of access, rectification, erasure and portability, according to 24 Horas, as well as the right to object. In practice, you will be able to ask a company what data it holds on you, correct it, have it deleted when there is no longer a reason to keep it, or object to certain uses, such as marketing.
| Right | What you can ask for |
|---|---|
| Access | To know what data a company or agency holds on you, what it uses it for and who it shares it with |
| Rectification | To correct inaccurate, outdated or incomplete data |
| Erasure | To have your data deleted when there is no longer a legal basis to keep it |
| Objection | To object to specific uses, such as advertising |
| Portability | To receive your data in a format that lets you take it to another provider |
Source: Law 21,719, according to 24 Horas and Garrigues. The description of each right is a Vivarae News summary; details and response deadlines are in the law.
Why the personal data law is being postponed
The government filed the bill on August 31, 2026 with one central argument: organizations are not ready. Undersecretary of Economy and Small Businesses Karlfranz Koehler presented the Chamber committee with a survey of 127 organizations covered by the law: 72% said they did not feel ready to comply by December 1 and 45.7% had not implemented any of the measures assessed, according to NIVEL4. Koehler said the bill seeks "a gradual, coordinated and systematic implementation".
The other reason is institutional. The Agency still has no board: two proposals to appoint it were sent to the Senate in 2026, one withdrawn and the other rejected. The bill uses the delay to change that governance: the board grows from three to five members, with six-year terms, no reelection and partial renewal every two years, and the first appointments must be made at least nine months before the law takes effect, according to Garrigues.
- Dec. 13, 2024Law 21,719 is publishedIt creates the Personal Data Protection Agency and sets its entry into force for December 1, 2026.
- Aug. 31, 2026The government files the postponementThe bill proposed December 1, 2027.
- Oct. 21, 2026Immediate-discussion urgency
- Oct. 28, 2026The Senate approves it 33 to 6With a new date: October 15, 2027.
- Nov. 5, 2026Chamber's Constitution CommitteeApproves it unanimously in general and the date 6 to 1; it goes to the Finance Committee and the floor.
- Dec. 1, 2026Current entry-into-force dateIf the postponement is not published before, the law takes effect that day.
- Oct. 15, 2027Proposed new date
Where the vote on the personal data law stands in Congress
| Stage | Date | Result |
|---|---|---|
| Government bill | August 31, 2026 | Proposed December 1, 2027 |
| Senate Constitution and Finance committees | October 26 and 27, 2026 | Change the date to October 15, 2027 |
| Senate floor | October 28, 2026 | Approved 33 to 6 |
| Chamber Constitution Committee | November 5, 2026 | Unanimous in general; the date, 6 to 1 |
| Chamber Finance Committee and floor | Pending | Must be dispatched before December 1 |
Sources: Garrigues, Emol and NIVEL4; the official record is on the Chamber's website. Deputy Juan Irarrázaval was named rapporteur.
The toughest debate in the Chamber was not the date but the penalties. The original law says that during its first twelve months, violations by smaller companies only receive written warnings. The committee voted 4 to 3 to extend that benefit to all companies. Committee chair Jaime Mulet argued that the transition was meant for small businesses, and some deputies warned that the change favors banks and large companies that handle sensitive data, according to NIVEL4.
What companies risk: fines and deadlines
Once in force, the personal data law classifies violations as minor, serious and very serious. Fines reach up to 20,000 UTM, according to 24 Horas; at November 2026's UTM (CLP 72,440), that is about CLP 1.449 billion.
| Type of violation | Maximum fine | Approximate equivalent (November 2026 UTM) |
|---|---|---|
| Minor | 5,000 UTM | CLP 362 million |
| Serious | 10,000 UTM | CLP 724 million |
| Very serious | 20,000 UTM | CLP 1.449 billion |
Sources: 20,000 UTM cap, 24 Horas; breakdown by type, Prey. Equivalents calculated by Vivarae News with the SII's November 2026 UTM. The law also provides higher penalties for repeat offenses by large companies; the sources consulted disagree on the details, so they are not included here.
For consumer groups, the delay has a cost. Conadecus warned that postponing the law delays stronger consumer rights. On the business side, lawyers advise not to slow down compliance work: if the bill is not published in time, the law takes effect on December 1 anyway.
What happens if the postponement is not published before December 1
Until the reform becomes law, the effective date is December 1, 2026. If the Chamber approves the text unchanged, the bill is dispatched and only needs to be enacted and published. If it amends it, as happened with the warnings provision, it must return to the Senate for a third reading, and if there are differences, to a joint committee. With immediate-discussion urgency, each chamber has six days to dispatch it.
- If it is published before December 1: the personal data law takes effect on October 15, 2027 and the Agency must appoint its board before then.
- If it is not published in time: Law 21,719 takes effect on December 1, 2026, with the Agency still lacking a board.
- For people, either way: Law 19,628 keeps protecting data in the meantime, though without a specialized enforcement authority.
The new law joins other digital rules requiring changes from companies and agencies, such as the Cybersecurity Framework Law. See how many cyberattacks are reported to ANCI and how to avoid online shopping scams.
Frequently asked questions
When does Chile's personal data law take effect?
The current legal date is December 1, 2026. Congress is moving to postpone it to October 15, 2027: the Senate has approved it and the Chamber must vote in committee and on the floor.
What is the Personal Data Protection Agency?
The autonomous body created by Law 21,719 to issue rules, inspect, sanction and resolve people's complaints about the use of their data.
What is the maximum fine under the personal data law?
Up to 20,000 UTM for very serious violations, about CLP 1.449 billion at November 2026's UTM.
What rights will I have over my data?
Access, rectification, erasure, objection and portability, among others, with an authority to complain to.
Why is it being postponed?
According to the government, 72% of 127 organizations surveyed did not feel ready and the Agency still has no board.
