On December 13, 2024, Law No. 21.719 regulating the protection and processing of personal data and creating the personal data protection agency was published in the Official Gazette of the Republic of Chile.

What is the scope of the Law?

The Law regulates the manner and conditions in which the processing of personal data of natural persons is carried out. It applies to any processing of personal data carried out by natural persons and legal entities, including public bodies.

The Law applies to the processing of personal data when:

• the controller or agent is established or constituted in the national territory;
• the agent, regardless of its place of establishment or constitution, carries out personal data processing operations on behalf of a controller established or constituted in the national territory;
• the agent is not established in the territory but their personal data processing operations intend to offer goods or services to Chileans, regardless of payment; and
• the agent is not established in the territory but monitors the behavior of data subjects located in the national territory, including analysis, tracking, profiling, or prediction of behavior.

Lastly, the Law does not apply to the processing of data carried out in the exercise of the freedom to express opinions and to inform. It also does not apply to the processing of personal data in relation to the personal activities of natural persons.

What are the key definitions of the Law?

The Law provides a number of definitions for specific terms, such as 'personal data' which is defined as any information relating to an identified or identifiable natural person. The term 'identifiable person' is defined as a person whose identity can be determined, directly or indirectly, in particular by reference to one or more identifiers such as name, identity card number, and analysis of elements specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

The Law also provides definitions for the terms 'publicly accessible sources,' 'anonymization,' 'personal database,' 'profiling,' and 'consent.'

What data subject rights and principles does the Law outline?

The Law empowers data subjects with the rights to access, rectify, delete, oppose, port, and block their personal data.

Regarding principles, the Law states that the principles of legality and fairness, purpose, proportionality, quality, responsibility, security, and transparency and information govern the processing of personal data.

Next steps

The Law will enter into force on the first day of the 24^th month following its publication in the Official Gazette.

You can read the Law, only available in Spanish, here.