ChileLey 21.719, notification of security breaches to the Agencia and to data subjects
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- From , report to the Agencia de Protección de Datos Personales, by the most expeditious means and without undue delay, any security breach that destroys, leaks, loses or alters personal data you process, or allows unauthorized communication of or access to it, when there is a reasonable risk to the rights and freedoms of the data subjects (Article 14 sexies).
- From , record each such communication, describing the nature of the breach, its effects, the categories of data and approximate number of data subjects affected, and the measures adopted to manage it and prevent future incidents (Article 14 sexies).
- From , when the breach concerns sensitive personal data, data of children under fourteen or data on economic, financial, banking or commercial obligations, also notify each affected data subject in clear and simple language, naming the data affected, the possible consequences and the measures adopted, or publish a notice in a national mass medium if individual notice is not possible (Article 14 sexies).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 14 sexies requires the controller to record its communications to the Agency about security breaches, describing the nature of the breach, its effects, the categories of data and approximate number of data subjects affected, and the measures taken. That is a breach register, and the elements named are not log-content values, so none is listed. The Act sets no period for keeping the register, names no audit or access party, and the article carries no territorial clause, so the hook is empty; the territorial rule of Article 1 bis is read on the row that cites it.
- Kind
- Explicit
- As of
- Provision
- Article 14 sexies (Ley 19.628, as inserted by Artículo primero of Ley 21.719)
- Trigger
- security_incident
What this law does
The controller must report to the Agencia, by the most expeditious means possible and without undue delay, security breaches that cause the accidental or unlawful destruction, leak, loss or alteration of the personal data it processes, or unauthorized communication of or access to those data, when there is a reasonable risk to the rights and freedoms of the data subjects.
The controller must record those communications, describing the nature of the breaches, their effects, the categories of data and the approximate number of data subjects affected, and the measures adopted to manage them and prevent future incidents. Where a breach concerns sensitive personal data, data of children under fourteen years of age or data on economic, financial, banking or commercial obligations, the controller must also notify the data subjects of those data.
The notice to data subjects must be in clear and simple language and must identify the data affected, the possible consequences of the security breach and the remedial or protective measures adopted. If notifying each affected data subject is not possible, the controller must publish a notice in a mass medium of national reach. Omitting the communications or the records required where security measures are breached is a grave infraction.
The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .