ChileLey 21.719, international transfers of personal data
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- From , transfer personal data out of Chile only to a recipient subject to the law of a country the Agencia has found adequate, under contractual clauses, binding corporate rules or another legal instrument that gives adequate safeguards, or under a compliance model or certification mechanism that gives adequate safeguards (Article 27).
- From , when none of those routes applies, make an international transfer only if it is specific and not habitual and falls within a case Article 27 lists, such as the data subject's express consent to that specific transfer.
- From , be ready to show the Agencia that each international transfer you made followed the rules of the Act (Article 28).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 27 to 29 set the routes for lawful international transfers, the Agencia's adequacy and model-clause functions and its supervision of transfers. They require no log or record of transfers, and Article 28 puts on the controller the burden of showing the transfer followed the Act, which is a burden of proof and not a record. No audit, access party or retention period is named, and the articles carry no territorial clause, so the hook is empty; the territorial rule of Article 1 bis is read on the row that cites it.
- Kind
- None
- As of
What this law does
International transfers of personal data are lawful, once the Act's other requirements for processing are met, where the recipient is subject to the law of a country with adequate levels of data protection, where contractual clauses, binding corporate rules or other legal instruments give adequate safeguards, or where the parties adopt a compliance model or certification mechanism that gives adequate safeguards.
Without an adequacy decision or adequate safeguards, a specific transfer that is not habitual may be made in the cases Article 27 lists, which include the express consent of the data subject to that specific and determined international transfer. The Agencia determines on reasoned grounds which countries have adequate levels of data protection.
The Agencia publishes on its website a list of adequate countries and model contractual clauses and other legal instruments for international data transfers. The controller that made an international data transfer must show the Agencia that the transfer followed the rules of the Act. The Agencia supervises international data transfers and may make recommendations, adopt precautionary measures and, in qualified cases, temporarily suspend the sending of data.
Carrying out international data transfers in contravention of the rules of the Act is a grave infraction. The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .