Is a payment provider, in Chile

Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 4 y 7 · Read the law's page

• This binds an institution that provides a service qualified as essential under article 4 (a State body, a public-service concessionaire, or a private institution in electricity, fuels, water, telecommunications, digital infrastructure, digital and managed information technology services, transport, banking, financial services and payment means, social-security administration, postal and courier services, institutional health care, or pharmaceutical production or research), and an institution the Agency designates an operator of vital importance (reached by declaring that you operate an essential service). The Agency identifies the specific infrastructure, processes or functions so qualified by exempt resolution. These duties apply from 1 January 2025.
• Apply permanently measures to prevent, report and resolve cybersecurity incidents, which may be technological, organizational, physical or informational (article 7).
• Implement the protocols and standards the Agencia Nacional de Ciberseguridad sets, and the particular cybersecurity standards issued under the sectoral regulation that applies to you (article 7).

Decreto N° 295, Reglamento de Reporte de Incidentes de Ciberseguridad de la Ley N° 21.663, arts. 2, 3, 5, 6 y 8 a 13 · Read the law's page

• This binds a public or private institution that provides a service qualified as essential and an institution qualified as an operator of vital importance (reached by declaring that you operate an essential service). The regulation details the reporting duty of article 9 of the Act, which applies from 1 March 2025.
• Report to the CSIRT Nacional every cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, affect the integrity or confidentiality of computer assets or the availability of a network or system, involve unauthorized use of or entry into networks or systems, or affect systems holding personal data (articles 2 and 3).
• Make every report through the notification platform the Agency provides, and leave all personal data out of it (articles 6 and 8).
• Send an early warning within a maximum of three hours from becoming aware of the incident, with at least the identification of the institution, its cybersecurity delegate, the date and time you learned of it, the signs of the incident and the assets affected (articles 5 and 9).
• Send a second report after seventy-two hours from becoming aware of the incident, or within twenty-four hours if you are an operator of vital importance whose essential service is affected, updating all the information with an initial assessment of severity and impact and any indicators of compromise (article 10).
• If you are an operator of vital importance, implement and report your action plan within no more than seven calendar days from becoming aware of the incident, including a data recovery programme, technical and administrative responsibilities and an estimate of the time to restore services (article 11).
• Within a maximum of fifteen calendar days from sending the early warning, and once the incident has been managed, send a final report; while it is not managed, send a partial report updated every fifteen days (articles 12 and 13).

Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 9 y 27 · Read the law's page

• This binds every public and private institution named in article 4, that is an institution that provides a service qualified as essential or is qualified as an operator of vital importance (reached by declaring that you operate an essential service). These duties apply from 1 March 2025.
• Report to the CSIRT Nacional, as soon as possible, any cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, or affect systems holding personal data (articles 9 and 27).
• Send an early warning within a maximum of three hours from becoming aware of the incident (article 9, letter a).
• Within a maximum of seventy-two hours, send an update with an initial assessment of the incident, its severity and impact, and indicators of compromise if available; if you are an operator of vital importance whose essential service is affected, send it within a maximum of twenty-four hours (article 9, letter b).
• Within a maximum of fifteen calendar days from the early warning, send a final report with a detailed description of the incident, the type of threat or main cause, the mitigation measures applied and under way, and any cross-border repercussions (article 9, letter c).
• If you are an operator of vital importance, also report your action plan to the CSIRT Nacional as soon as you adopt it, no later than seven calendar days after becoming aware of the incident (article 9).

Ley 21.521, Ley Fintec, Título III, Del Sistema de Finanzas Abiertas (arts. 16 to 24) · Read the law's page

• Title III binds nobody until the Comisión para el Mercado Financiero's rules under it enter into force (Article primero transitorio).
• Once Title III applies, obtain the customer's prior and explicit consent, free, informed, express and specific as to the type of financial information, the purpose and the maximum period of validity, before querying financial information or initiating payments on the customer's behalf (Article 23).
• Stop using a consent the customer has revoked for new information queries or new payment orders (Article 23).
• Once Title III applies, banks, card issuers and the other institutions the Commission designates give access to, and deliver, the customer information that registered information-based service providers request with the customer's consent (Articles 18 and 19).