ChileLey 21.719, Regula la Protección y el Tratamiento de los Datos Personales
Ley 21.719 Regula la Protección y el Tratamiento de los Datos Personales y Crea la Agencia de Protección de Datos Personales (Boletines 11.092-07 y 11.144-07, refundidos)
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- From , obtain a lawful basis before processing personal data of a person in Chile.NIST Privacy FrameworkCT.PO-P1
- Report to the Agencia de Protección de Datos Personales, by the most expeditious means and without undue delay, any breach of security measures that destroys, leaks, loses or alters personal data you process, or allows unauthorized communication of or access to it, when there is a reasonable risk to the rights and freedoms of the data subjects, and keep a record of each such report.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a web page whose use of the data is barred by a robots.txt file or the site's terms remain a source whose "acceso o consulta puede ser efectuada en forma lícita por cualquier persona" (access or consultation can lawfully be carried out by any person), so that it counts as a fuente de acceso público under the amended Article 2?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 14 sexies requires the controller to report to the Agency a security breach that creates a reasonable risk to data subjects' rights, and to record those communications, describing the nature of the breach, its effects, the categories of data and approximate number of data subjects affected, and the measures taken. That is a breach register; the elements named are not log-content values, so none is listed. Article 14 quinquies makes the controller prove the existence and operation of its security measures in an administrative or judicial dispute after an incident, which is a burden of proof and not a record. Article 30 bis(c) lets the Agency require any document, book or record from those who process data, which is the regulator's power to inspect on its own initiative. The Act sets no period for keeping the register, and the Registro Nacional de Sanciones y Cumplimiento is the Agency's own register. The Act's substantive provisions apply from .
- Kind
- Explicit
- As of
- Provision
- Article 14 sexies (Ley 19.628, as inserted by Artículo primero of Ley 21.719)
- Trigger
- security_incident
What this law does
Ley 21.719 replaces Ley 19.628 with a General Data Protection Regulation (GDPR)-influenced comprehensive regime covering both public and private-sector processing and amends Ley 20.285 (public information access) and Ley 19.496 (consumer protection) in the same act.
It was promulgated and published in the Diario Oficial , but its own transitory provisions delay commencement of the substantive amendments to the twenty-fourth month after publication, which the primary source's own version banner confirms as . It was amended before taking effect by Ley 21.755 (Article 31, Diario Oficial ). It was amended again by Ley 21.806 (Article 54, Diario Oficial ).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .