Processes personal data, in Chile

Ley 19.628, sobre Protección de la Vida Privada (Ley sobre Protección de Datos de Carácter Personal) · Read the law's page

• Obtain a lawful basis before processing personal data of a person in Chile through a registry or data bank, whether the processor is a public body or a private party, per Ley 19.628 Article 1.
• Be prepared to compensate patrimonial and moral damage caused by improper treatment of personal data; Article 23 arms the data subject with a direct civil action, joinable with the claim establishing the infraction.

Ley 20.120, Sobre la Investigación Científica en el Ser Humano, su Genoma, y Prohíbe la Clonación Humana, art. 9 (identidad genética) · Read the law's page

• Investigate and determine a person's genetic identity only with that person's prior and informed consent or, failing that, the consent of whoever must supply the person's will in accordance with the law (Article 9); courts keep their powers in the cases and form the law establishes.

Ley 20.575, arts. 1 and 2, Establece el Principio de Finalidad en el Tratamiento de Datos Personales (principio de finalidad y distribuidores) · Read the law's page

• Process economic, financial, banking and commercial personal data only for the evaluation of commercial risk and the credit process (Article 1).
• Communicate such data only to established commerce, for the credit process, and to the entities that take part in the evaluation of commercial risk, and only for that purpose (Article 1).
• Do not require this information in personnel selection, pre-school, school or higher education admission, emergency medical care or applications for a public post (Article 1).

Ley 21.096, Consagra el Derecho a Protección de los Datos Personales (Constitución Política, artículo 19 N° 4) · Read the law's page

• Process personal data in the form and under the conditions the law determines, because the Constitution protects a person's personal data (Article 19 No. 4).

Ley 21.383, Modifica la Carta Fundamental, para Establecer el Desarrollo Científico y Tecnológico al Servicio de las Personas (Constitución Política, artículo 19 N° 1) · Read the law's page

• Carry out scientific and technological work on persons with respect for life and for physical and psychological integrity (Article 19 No. 1, final paragraph).
• Treat brain activity and the information coming from it as specially safeguarded in any use of such work on persons, under the requirements, conditions and restrictions the law sets.

Ley 20.575, arts. 3 and 4, Establece el Principio de Finalidad en el Tratamiento de Datos Personales (registro de acceso y encargado del tratamiento) · Read the law's page

• Keep a system recording access to and delivery of economic, financial, banking and commercial data, naming who requested it, the reason, the date and hour of the request and who was responsible for the delivery (Article 3).
• Let a data subject request, every four months and free of charge, the information in that system for the last twelve months (Article 3).
• Designate a natural person in charge of data processing to whom data subjects can turn to exercise their rights under Ley 19.628 (Article 4).

Ley 20.584, Regula los Derechos y Deberes que Tienen las Personas en Relación con Acciones Vinculadas a su Atención en Salud, arts. 12 and 13 (ficha clínica) · Read the law's page

• Treat all information in a ficha clínica, and in the studies and documents recording procedures and treatments, as sensitive data under Ley 19.628 (Article 12).
• Keep the ficha clínica for at least fifteen years, complete, accessible, preserved and confidential in whatever medium it is held (Articles 12 and 13).
• Give no access to the ficha clínica to third parties not directly related to the person's health care, including staff of the same provider who are not linked to the care (Article 13).
• Deliver or make accessible the ficha clínica, in whole or in part, on the express request of the holder, the holder's legal representative or heirs, and of the other persons and bodies Article 13 lists, in the cases and form it states.
• Where you receive access to a ficha clínica, keep the holder's identity and the sensitive data in it confidential and use the information only for the purpose for which it was requested (Article 13).

Ley 21.521, Ley Fintec, Título III, Del Sistema de Finanzas Abiertas (arts. 16 to 24) · Read the law's page

• Title III binds nobody until the Comisión para el Mercado Financiero's rules under it enter into force (Article primero transitorio).
• Once Title III applies, obtain the customer's prior and explicit consent, free, informed, express and specific as to the type of financial information, the purpose and the maximum period of validity, before querying financial information or initiating payments on the customer's behalf (Article 23).
• Stop using a consent the customer has revoked for new information queries or new payment orders (Article 23).
• Once Title III applies, banks, card issuers and the other institutions the Commission designates give access to, and deliver, the customer information that registered information-based service providers request with the customer's consent (Articles 18 and 19).

Ley 21.719, Regula la Protección y el Tratamiento de los Datos Personales y Crea la Agencia de Protección de Datos Personales (Boletines 11.092-07 y 11.144-07, refundidos) · Read the law's page

• From 1 December 2026, obtain a lawful basis before processing personal data of a person in Chile.
• Report to the Agencia de Protección de Datos Personales, by the most expeditious means and without undue delay, any breach of security measures that destroys, leaks, loses or alters personal data you process, or allows unauthorized communication of or access to it, when there is a reasonable risk to the rights and freedoms of the data subjects, and keep a record of each such report.

Ley 21.719, art. 14 sexies of Ley 19.628 as inserted by Artículo primero (deber de reportar las vulneraciones a las medidas de seguridad) · Read the law's page

• From 1 December 2026, report to the Agencia de Protección de Datos Personales, by the most expeditious means and without undue delay, any security breach that destroys, leaks, loses or alters personal data you process, or allows unauthorized communication of or access to it, when there is a reasonable risk to the rights and freedoms of the data subjects (Article 14 sexies).
• From 1 December 2026, record each such communication, describing the nature of the breach, its effects, the categories of data and approximate number of data subjects affected, and the measures adopted to manage it and prevent future incidents (Article 14 sexies).
• From 1 December 2026, when the breach concerns sensitive personal data, data of children under fourteen or data on economic, financial, banking or commercial obligations, also notify each affected data subject in clear and simple language, naming the data affected, the possible consequences and the measures adopted, or publish a notice in a national mass medium if individual notice is not possible (Article 14 sexies).

Ley 21.719, art. 16 bis of Ley 19.628 as inserted by Artículo primero (datos personales sensibles relativos a la salud y al perfil biológico humano) · Read the law's page

• From 1 December 2026, process data on a person's health or human biological profile (including genetic, proteomic or metabolic data) only with the data subject's express consent under Article 16 and only for the purposes the special health laws provide, unless an Article 16 bis exception applies.
• From 1 December 2026, do not process or cede health or biological profile data, or biological samples tied to an identifiable person, that were collected in a labor, educational, sports, social, insurance, security or identification setting, unless the law expressly authorizes it in a qualified case (Article 16 bis).

Ley 21.719, art. 16 of Ley 19.628 as substituted by Artículo primero (tratamiento de datos personales sensibles) · Read the law's page

• From 1 December 2026, process sensitive personal data (data revealing racial or ethnic origin, political, union or trade affiliation, socioeconomic situation, ideological or philosophical convictions or religious beliefs, and data on health, the human biological profile, biometrics, sex life, sexual orientation or gender identity) only with the data subject's express consent, unless an Article 16 exception applies.
• From 1 December 2026, rely on the Article 16 exceptions to process sensitive personal data without consent only in the cases it lists, such as data the data subject has manifestly made public for the purposes of their publication, or processing indispensable to safeguard the life, health or integrity of a person who cannot consent.

Ley 21.719, art. 35 (sanciones) y arts. 42-45 (procedimiento administrativo y judicial) · Read the law's page

• Adopt, within sixty days, the measures the Agencia de Protección de Datos Personales sets to remedy the cause of a sanction.

Ley 21.719, arts. 27 to 29 of Ley 19.628 as substituted by Artículo primero (transferencia internacional de datos) · Read the law's page

• From 1 December 2026, transfer personal data out of Chile only to a recipient subject to the law of a country the Agencia has found adequate, under contractual clauses, binding corporate rules or another legal instrument that gives adequate safeguards, or under a compliance model or certification mechanism that gives adequate safeguards (Article 27).
• From 1 December 2026, when none of those routes applies, make an international transfer only if it is specific and not habitual and falls within a case Article 27 lists, such as the data subject's express consent to that specific transfer.
• From 1 December 2026, be ready to show the Agencia that each international transfer you made followed the rules of the Act (Article 28).

Ley 21.719, arts. 4 to 11 of Ley 19.628 as substituted by Artículo primero (derechos del titular de datos) · Read the law's page

• From 1 December 2026, confirm on request whether you process a person's personal data and, if you do, give the person access to the data and to the information Article 5 lists.
• From 1 December 2026, rectify inaccurate, outdated or incomplete personal data on request, and tell those to whom you communicated or ceded the data about the rectification unless that is impossible or demands a disproportionate effort (Article 6).
• From 1 December 2026, delete personal data on request in the cases Article 7 lists, unless processing is necessary for a purpose Article 7 excepts, such as complying with a legal obligation or performing a contract with the data subject.
• From 1 December 2026, stop a processing the data subject objects to when it rests on your legitimate interests, unless you prove compelling legitimate grounds, and stop processing carried out exclusively for direct marketing, including profiling, when the data subject objects (Article 8).
• From 1 December 2026, suspend processing temporarily when the data subject files a rectification, suppression or opposition request and asks for it, until the request is resolved (Articles 8 ter and 11).
• From 1 December 2026, give a data subject who asks a copy of the personal data the data subject supplied, in a structured, commonly used electronic format, and transfer it to another controller, where the processing is automated and based on consent (Article 9).
• From 1 December 2026, handle rectification, suppression and opposition requests free of charge and answer every request within thirty calendar days, extendable once by thirty calendar days (Articles 10 and 11).