ChileLey 21.719, rights of access, rectification, suppression, opposition, blocking and portability
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- From , confirm on request whether you process a person's personal data and, if you do, give the person access to the data and to the information Article 5 lists.
- From , rectify inaccurate, outdated or incomplete personal data on request, and tell those to whom you communicated or ceded the data about the rectification unless that is impossible or demands a disproportionate effort (Article 6).
- From , delete personal data on request in the cases Article 7 lists, unless processing is necessary for a purpose Article 7 excepts, such as complying with a legal obligation or performing a contract with the data subject.
- From , stop a processing the data subject objects to when it rests on your legitimate interests, unless you prove compelling legitimate grounds, and stop processing carried out exclusively for direct marketing, including profiling, when the data subject objects (Article 8).
- From , suspend processing temporarily when the data subject files a rectification, suppression or opposition request and asks for it, until the request is resolved (Articles 8 ter and 11).
- From , give a data subject who asks a copy of the personal data the data subject supplied, in a structured, commonly used electronic format, and transfer it to another controller, where the processing is automated and based on consent (Article 9).
- From , handle rectification, suppression and opposition requests free of charge and answer every request within thirty calendar days, extendable once by thirty calendar days (Articles 10 and 11).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 11 requires the controller to keep the backups that let it show that it sent its response to a data subject's request, the date of the response and its full content. That is a record of responses to rights requests, and the elements named are not log-content values, so none is listed. The Act sets no period for keeping the backups, names no audit or access party, and the article carries no territorial clause, so the hook is empty; the territorial rule of Article 1 bis is read on the row that cites it.
- Kind
- Explicit
- As of
- Provision
- Article 11 (Ley 19.628, as substituted by Artículo primero of Ley 21.719)
- Trigger
- consent_or_optout
What this law does
Every person has the rights of access, rectification, suppression, opposition, portability and blocking over the person's personal data, and those rights are personal, non-transferable, non-waivable and cannot be limited by any act or agreement. The controller must confirm on request whether it processes the data subject's personal data and, if it does, give access to the data and to their origin, the purposes of the processing, the recipients and the period for which the data will be processed.
The controller must rectify inaccurate, outdated or incomplete personal data on request and communicate the rectified data to those to whom it communicated or ceded them, unless that is impossible or demands a disproportionate effort. A data subject may require deletion of personal data that are no longer necessary for the purposes of the processing, where consent has been revoked and no other legal basis exists, or where the controller obtained or processed the data unlawfully.
A data subject may object to a processing that rests on the controller's legitimate interests, which the controller must then stop unless it proves compelling legitimate grounds, and to a processing carried out exclusively for direct marketing, including profiling. A data subject may request the temporary suspension of any processing of the data subject's personal data while a request for rectification, suppression or opposition is unresolved.
A data subject may obtain a copy of the personal data the data subject supplied to the controller in a structured, commonly used electronic format and transfer it to another controller where the processing is automated and based on the data subject's consent. The rights of rectification, suppression and opposition are always exercised free of charge, and the right of access is free at least once each quarter.
The controller must acknowledge a request and decide on it within thirty calendar days of receipt, a period it may extend once by up to thirty calendar days. Impeding or obstructing the legitimate exercise of the rights of access, rectification, suppression, opposition or portability is a grave infraction. The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.
When LexLint raises it
When your app profile says your app processes personal data, sends automated outreach or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .