ChileLey Marco de Ciberseguridad, Essential Services and General Duties
Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 4 y 7
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds an institution that provides a service qualified as essential under article 4 (a State body, a public-service concessionaire, or a private institution in electricity, fuels, water, telecommunications, digital infrastructure, digital and managed information technology services, transport, banking, financial services and payment means, social-security administration, postal and courier services, institutional health care, or pharmaceutical production or research), and an institution the Agency designates an operator of vital importance (reached by declaring that you operate an essential service). The Agency identifies the specific infrastructure, processes or functions so qualified by exempt resolution. These duties apply from .
- Apply permanently measures to prevent, report and resolve cybersecurity incidents, which may be technological, organizational, physical or informational (article 7).
- Implement the protocols and standards the Agencia Nacional de Ciberseguridad sets, and the particular cybersecurity standards issued under the sectoral regulation that applies to you (article 7).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Fines for infractions of the Act, classed minor, serious or very serious, of up to 5,000, 10,000 and 20,000 monthly tax units, and up to 10,000, 20,000 and 40,000 monthly tax units for an operator of vital importance (article 40).
Settledness
- As of
- Open questions
- Which specific infrastructure, processes and functions has the Agency qualified as essential by exempt resolution under article 4?
- Does the general duty in article 7 bind every institution in an essential-service sector before the Agency has identified its specific infrastructure?
What this law does
Article 4 of Ley N° 21.663 applies the Act to institutions that provide services qualified as essential and to institutions qualified as operators of vital importance.
Article 4 names as essential the services of State bodies, public-service concessionaires and private institutions in electricity, fuels, water, telecommunications, digital infrastructure, digital and managed information technology services, transport, banking, financial services and payment means, social-security administration, postal and courier services, institutional health care and pharmaceutical production or research.
Article 4 provides that the Agency identifies by exempt resolution the specific infrastructure, processes or functions qualified as essential. Article 7 requires the covered institutions to apply permanent measures to prevent, report and resolve cybersecurity incidents. Article 7 makes compliance depend on implementing the protocols and standards the Agency sets and the particular cybersecurity standards issued under the relevant sectoral regulation. Articles 4 and 7 apply from .
The Agencia Nacional de Ciberseguridad supervises and sanctions infractions of the Act, outside the competence of a sectoral authority.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.