Chile

The controller must report to the Agencia, by the most expeditious means possible and without undue delay, security breaches that cause the accidental or unlawful destruction, leak, loss or alteration of the personal data it processes, or unauthorized communication of or access to those data, when there is a reasonable risk to the rights and freedoms of the data subjects.

The controller must record those communications, describing the nature of the breaches, their effects, the categories of data and the approximate number of data subjects affected, and the measures adopted to manage them and prevent future incidents. Where a breach concerns sensitive personal data, data of children under fourteen years of age or data on economic, financial, banking or commercial obligations, the controller must also notify the data subjects of those data.

The notice to data subjects must be in clear and simple language and must identify the data affected, the possible consequences of the security breach and the remedial or protective measures adopted. If notifying each affected data subject is not possible, the controller must publish a notice in a mass medium of national reach. Omitting the communications or the records required where security measures are breached is a grave infraction.

The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.

Ley 19.628 governs the processing of personal data in registries or data banks by both public bodies and private parties, with an exception for processing carried out in the exercise of freedom of opinion and information.

Its Título V arms a data subject with a direct civil action: the controller, whether a private person or a public body, must compensate the patrimonial and moral damage caused by improper treatment of the data, and that damages claim may be brought together with the claim establishing the infraction itself, under summary civil procedure.

The statute remains the law in force in Chile as of this date; its substantive provisions are due to be superseded by Ley 21.719 on 1 December 2026, and several of its articles already carry pending-amendment banners on the primary source pointing to that commencement date.

Ley 21.719 replaces Ley 19.628 with a General Data Protection Regulation (GDPR)-influenced comprehensive regime covering both public and private-sector processing and amends Ley 20.285 (public information access) and Ley 19.496 (consumer protection) in the same act.

It was promulgated 25 November 2024 and published in the Diario Oficial 13 December 2024, but its own transitory provisions delay commencement of the substantive amendments to the twenty-fourth month after publication, which the primary source's own version banner confirms as 1 December 2026. It was amended before taking effect by Ley 21.755 (Article 31, Diario Oficial 11 July 2025). It was amended again by Ley 21.806 (Article 54, Diario Oficial 5 February 2026).

International transfers of personal data are lawful, once the Act's other requirements for processing are met, where the recipient is subject to the law of a country with adequate levels of data protection, where contractual clauses, binding corporate rules or other legal instruments give adequate safeguards, or where the parties adopt a compliance model or certification mechanism that gives adequate safeguards.

Without an adequacy decision or adequate safeguards, a specific transfer that is not habitual may be made in the cases Article 27 lists, which include the express consent of the data subject to that specific and determined international transfer. The Agencia determines on reasoned grounds which countries have adequate levels of data protection.

The Agencia publishes on its website a list of adequate countries and model contractual clauses and other legal instruments for international data transfers. The controller that made an international data transfer must show the Agencia that the transfer followed the rules of the Act. The Agencia supervises international data transfers and may make recommendations, adopt precautionary measures and, in qualified cases, temporarily suspend the sending of data.

Carrying out international data transfers in contravention of the rules of the Act is a grave infraction. The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.

A data subject has the right to object to, and not to be the subject of, decisions based on the automated processing of the data subject's personal data, including profiling, that produce legal effects on the subject or significantly affect the subject.

The right does not apply where the decision is necessary to conclude or perform a contract between the data subject and the controller, where the data subject has given prior and express consent in the form Article 12 prescribes, or where a law so provides, to the extent that it requires safeguards for the data subject's rights and freedoms.

In every case of a decision based on automated processing, including those three, the controller must adopt the measures needed to secure the data subject's rights and freedoms, right to information and transparency, right to obtain an explanation, to human intervention, to express a point of view and to request review of the decision.

The amendments to Ley 19.628 contained in the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.

Every person has the rights of access, rectification, suppression, opposition, portability and blocking over the person's personal data, and those rights are personal, non-transferable, non-waivable and cannot be limited by any act or agreement. The controller must confirm on request whether it processes the data subject's personal data and, if it does, give access to the data and to their origin, the purposes of the processing, the recipients and the period for which the data will be processed.

The controller must rectify inaccurate, outdated or incomplete personal data on request and communicate the rectified data to those to whom it communicated or ceded them, unless that is impossible or demands a disproportionate effort. A data subject may require deletion of personal data that are no longer necessary for the purposes of the processing, where consent has been revoked and no other legal basis exists, or where the controller obtained or processed the data unlawfully.

A data subject may object to a processing that rests on the controller's legitimate interests, which the controller must then stop unless it proves compelling legitimate grounds, and to a processing carried out exclusively for direct marketing, including profiling. A data subject may request the temporary suspension of any processing of the data subject's personal data while a request for rectification, suppression or opposition is unresolved.

A data subject may obtain a copy of the personal data the data subject supplied to the controller in a structured, commonly used electronic format and transfer it to another controller where the processing is automated and based on the data subject's consent. The rights of rectification, suppression and opposition are always exercised free of charge, and the right of access is free at least once each quarter.

The controller must acknowledge a request and decide on it within thirty calendar days of receipt, a period it may extend once by up to thirty calendar days. Impeding or obstructing the legitimate exercise of the rights of access, rectification, suppression, opposition or portability is a grave infraction. The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.

Ley 21.719 establishes the Agencia de Protección de Datos Personales (APDP) as data-protection regulator, with an administrative-sanction procedure for infractions classified as leve, grave, or gravísima, escalating fines by tier, and a further judicial review of Agency decisions before the Corte de Apelaciones.

Article 35 sanctions a leve infraction with a written warning or a fine of up to 5,000 unidades tributarias mensuales, a grave infraction with a fine of up to 10,000, and a gravísima infraction with a fine of up to 20,000 unidades tributarias mensuales. Persons affected by a decision of a public body handling their data under this law may also bring a claim before the Corte de Apelaciones under the same procedure.

Sensitive personal data are data that reveal racial or ethnic origin, political, union or trade affiliation, socioeconomic situation, ideological or philosophical convictions or religious beliefs, and data on health, the human biological profile, biometrics, sex life, sexual orientation and gender identity. Sensitive personal data may be processed only with the express consent of the data subject, given in a written or verbal statement or by an equivalent technological means.

Sensitive personal data may also be processed without consent where the data subject has manifestly made them public and the processing relates to the purposes for which they were published, or where the processing is indispensable to safeguard the life, health or physical or mental integrity of the data subject or another person, or the data subject is physically or legally unable to consent.

The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.

Where the express consent rule of Article 16 is met, health data and data on the human biological profile, such as genetic, proteomic or metabolic data, may be processed only for the purposes provided by the special laws on health.

The processing and ceding of health and biological profile data, and of biological samples associated with an identifiable person, is prohibited where the data or samples were collected in a labor, educational, sports, social, insurance, security or identification setting, unless the law expressly authorizes the processing in qualified cases.

Health and biological profile data may be processed without consent in cases of a legally decreed health alert and where necessary for preventive or occupational medicine, assessment of a worker's work capacity, medical diagnosis, provision of health or social care or treatment, or management of health and social care systems and services.

The amendments to Ley 19.628 made by the first permanent article of Ley 21.719 enter into force on the first day of the twenty-fourth month after the law's publication in the Diario Oficial.

Article 2 criminalizes accessing a computer system without authorization, or exceeding held authorization, only where the actor also defeats a technical barrier or technological security measure protecting that system.

Both elements are conjunctive on the statute's own text, so crawling a page that carries no such barrier, a public, unauthenticated page, does not by itself satisfy this offence; accessing a system behind a login, a paywall, or another technical access control without authorization does.

The offence carries presidio menor en su grado mínimo (a short custodial term) or a fine of eleven to twenty unidades tributarias mensuales, rising where the access is committed with intent to appropriate or use the system's information (art. 2, second paragraph, not quoted here). This statute repealed and replaced Ley 19.223 to align Chile with the Budapest Convention on Cybercrime.

Article 5 of Ley N° 21.663 lets the Agency qualify as an operator of vital importance a provider of essential services whose service depends on computer networks and systems and whose interruption would significantly affect public security and order, the continuous provision of essential services or the functions of the State. Article 8, letter a) requires an operator of vital importance to implement a continuous information security management system.

Article 8, letter c) requires operational continuity and cybersecurity plans that are certified under article 28 and reviewed at least every two years. Article 8, letter d) requires continuous review operations, exercises, drills and analyses of networks and systems, and communication of the information on harmful programs or actions to the computer security incident response team (CSIRT) Nacional.

Article 8, letter e) requires prompt measures to reduce the impact and spread of a cybersecurity incident, including restricting the use of or access to computer systems if necessary. Article 8, letter g) requires informing potentially affected persons, when the Agency requires it, of incidents or cyberattacks that could seriously compromise their information or computer networks and systems.

Article 8, letter i) requires an operator of vital importance to designate a cybersecurity delegate who acts as the Agency's counterpart. Articles 5 and 8 apply from 1 March 2025. The fines of article 40 reach up to 10,000, 20,000 or 40,000 monthly tax units for an operator of vital importance.

Article 4 of Ley N° 21.663 applies the Act to institutions that provide services qualified as essential and to institutions qualified as operators of vital importance.

Article 4 names as essential the services of State bodies, public-service concessionaires and private institutions in electricity, fuels, water, telecommunications, digital infrastructure, digital and managed information technology services, transport, banking, financial services and payment means, social-security administration, postal and courier services, institutional health care and pharmaceutical production or research.

Article 4 provides that the Agency identifies by exempt resolution the specific infrastructure, processes or functions qualified as essential. Article 7 requires the covered institutions to apply permanent measures to prevent, report and resolve cybersecurity incidents. Article 7 makes compliance depend on implementing the protocols and standards the Agency sets and the particular cybersecurity standards issued under the relevant sectoral regulation. Articles 4 and 7 apply from 1 January 2025.

The Agencia Nacional de Ciberseguridad supervises and sanctions infractions of the Act, outside the competence of a sectoral authority.

Article 9 of Ley N° 21.663 provides that the content of the reports it describes is to be regulated by a regulation issued by the ministry in charge of public security. Article 2 of the regulation requires public and private institutions that provide services qualified as essential, and those qualified as operators of vital importance, to report to the computer security incident response team (CSIRT) Nacional cyberattacks and cybersecurity incidents that may have significant effects.

Article 3 treats an incident as having a significant effect if it can interrupt an essential service, affect the physical integrity or health of persons, affect the integrity or confidentiality of computer assets or the availability of a network or system, involve unauthorized use of or entry into networks or systems, or affect systems holding personal data.

Article 5 sets the minimum content of a report, including the identification of the institution, its cybersecurity delegate, the date and time of awareness, any evidence of a crime, the signs of the incident, the assets affected and the indicators of compromise. Article 6 requires the report to omit all personal data, and an IP address is not treated as personal data for that purpose.

Article 8 requires reports to be made through the notification platform the Agency provides, which operates every hour of every day of the year. Article 9 requires an early warning within a maximum of three hours from the institution becoming aware of the incident. Article 12 requires a final report within a maximum of fifteen calendar days from sending the early warning, provided the incident has been managed.

Article 13 requires a partial report on the state of an incident not yet managed, updated every fifteen days from the last submission. Article 11 requires an operator of vital importance to implement and report its action plan within no more than seven calendar days from becoming aware of the incident. Failing to meet the reporting duty of article 9 of the Act is a serious infraction under article 38 of the Act.

Article 9 of Ley N° 21.663 requires every public and private institution named in article 4 to report to the computer security incident response team (CSIRT) Nacional cyberattacks and cybersecurity incidents that may have significant effects, as soon as possible. Article 9, letter a) requires an early warning within a maximum of three hours from becoming aware of the incident.

Article 9, letter b) requires an update within seventy-two hours, or within twenty-four hours where the incident affects the essential service of an operator of vital importance. Article 9, letter c) requires a final report within a maximum of fifteen calendar days from sending the early warning.

Article 9 requires an operator of vital importance also to report its action plan to the CSIRT Nacional as soon as it is adopted, within no more than seven calendar days of becoming aware of the incident. Article 27 treats an incident as having a significant effect if it can interrupt the continuity of an essential service, affect the physical integrity or health of persons, or affect computer systems holding personal data. Article 9 applies from 1 March 2025. Failing to meet the reporting duty of article 9 is a serious infraction under article 38 of the Act.