Does Law 21.719 apply to my small business?

Yes. The law applies to the processing of personal data, not to company size. A blog with a comments form or a store with a newsletter already processes personal data. The obligation is the same for big and small companies.

What is the maximum fine for breaching Law 21.719?

Up to 20,000 UTM for very serious infringements (art. 35). On recidivism, and for a company that is not a smaller company under article two of law 20,416, the fine may reach 2% of annual revenue from sales and services in the last calendar year if the infringement is serious, and 4% if it is very serious (art. 35, final paragraph).

If I already comply with European GDPR, am I covered in Chile?

Not automatically. GDPR compliance is a good baseline, but Law 21.719 has specific requirements: locally adapted privacy notices, contracts with providers in Chile (DPA under Chilean law), local interpretation of legitimate interest, and adequacy rules the APDP is still issuing.

When does Law 21.719 enter into force?

On December 1st, 2026, full enforcement begins. There is a transition period before that, but systems should be ready earlier to avoid being non-compliant from day one.

It is the Personal Data Protection Agency created by Law 21.719. An autonomous public-law corporation with its own legal personality. Real powers: issues regulations, audits, receives complaints, opens investigations, imposes sanctions and publishes a National Registry of Sanctions.

What should I require from my SaaS provider to comply with the law?

A signed DPA, documented data residency, defined deadline to notify breaches, full data exportability when ending the contract, and access to audit logs. If your provider cannot offer these five points, there is concrete risk.

Chile Law 21.719: how to tell if your system complies

On December 1st, 2026, Chile’s Law 21.719 enters full force. It creates the Personal Data Protection Agency (APDP) and replaces the older Law 19.628 from 1999. For most medium companies the debate has stayed abstract: principles, rights, sanctions. Concrete tools to decide are missing.

This article is the opposite. It is a guide to evaluate whether the system your company uses today, or the one being built for you, can meet what the law requires. It does not sell a plugin. It does not sell consulting. It gives questions and criteria so you and your team make the call.

What changes with the new law

Law 21.719 does not start from scratch. It substantially modifies Law 19.628 from 1999, renaming it “Personal Data Protection” and reforming most of its articles. The difference matters: the older law never had an administrative sanctioning authority, so the last twenty years of complaints went through civil courts or through SERNAC under consumer law.

The new law changes that. It creates the APDP, an autonomous public-law corporation with its own legal personality, functional independence from the executive, and real powers: it issues regulations, audits, receives complaints, opens investigations on its own initiative, imposes sanctions, orders corrective measures and publishes a National Registry of Sanctions and Compliance.

What the law requires from your system

§ Five mandatory demonstrations

01 Who consented to what, and when. Free, informed, specific, unambiguous consent. Explicit for sensitive data.
02 Legal basis for each processing. Consent is not the only one: legal obligation, contract, legitimate interest, defence of rights.
03 That you can fulfil data subject rights within deadline. Access, rectification, deletion, objection and portability (art. 14 ter, letter f), plus objection to automated decisions (art. 8 bis) and temporary blocking (art. 8 ter). The deadline is thirty calendar days, extendable once (art. 11, paragraph 2), and temporary blocking is resolved within two business days.
04 What you process, why, on what basis and for how long. Categories of data, universe of people, recipients, purposes and legal basis, published in your policy (art. 14 ter, letter d), plus a retention period defined per category (art. 3, letter c). The internal inventory that makes writing all that possible is good practice, and the statute never asks for it.
05 That you know when there was a breach and whom to notify. Report to the APDP by the most expeditious means available and without undue delay, whenever there is reasonable risk to the rights of data subjects (art. 14 sexies).

§ Important observation

The law applies to the processing of personal data, not to the size of your company. A blog with a comments form already processes personal data. A store with a newsletter too. Thinking “we are too small for them to audit us” is the most expensive position your company can take.

The six technical capabilities

§ Technical map

If your system cannot do one of these six things, there is a real problem.

Consents

Who consented to what and when. Granular and revocable.

ARCO+ map

Access, rectification, deletion, opposition, portability, blocking.

What you publish about each purpose

Categories of data, recipients, lawful basis and retention period, kept current (art. 14 ter, letter d, and art. 3, letter c).

Immutable logs

Traceability the operator cannot modify.

Automatic retention

Deletion or anonymisation when the term expires.

Breaches

Detect and notify the APDP without undue delay.

What each capability looks like

§ Self-diagnosis

Complies vs. does not comply.

When it works

When it fails

01 Consents

Panel with history per person and revocation that propagates to all modules.

Excel on someone's laptop. Or worse: 'they accepted the terms at signup'.

02 ARCO+ map

Locate all data of a person in minutes. Automated workflow per system.

Someone logs into 5 systems, copies to Word, deletes from some, forgets backups.

03 Internal processing inventory

A living inventory accessible to legal and to whoever runs the systems, updated with every change, which makes it possible to publish what art. 14 ter, letter d, requires.

'We have a privacy policy on the website.' Published without knowing what you process, it says nothing.

04 Logs

Append-only, hash chain or write-once. Administrator cannot edit.

Editable logs. Or 7-day rotation without archive.

05 Retention

Policies per category. Automated deletion routines.

'We keep everything just in case.'

06 Breaches

Automatic detection. Escalation flow. APDP template ready.

You find out because a client saw their data on pastebin.

Honest examples from systems we built

At TCultura, an event platform, every sign-up separates consent by purpose: one checkbox to attend (contract basis), another for future invitations (consent), another for public event photos (explicit consent). The attendee can revoke any of them without emailing support.

At Bioaudita, an organic certification platform, traceability of who accesses which data is part of the data model from day one. A producer can request their full history and receive it in exportable format.

At Sign DataNubi, an electronic signature platform, each signature is cryptographically chained to the previous one through a hash chain. Modifying a single past signature breaks the entire chain. This was done for Chile’s Law 19.799 on electronic documents, not for 21.719. But the pattern serves the same purpose: the system operator cannot tamper with evidence.

Law 21.719 compliance is not a plugin. It is architecture.

Quick audit checklist

§ Ten questions for your team

Print this and answer it with your IT team.

01 Your system has a panel where you can see who consented to what and when.
02 You can locate all of a specific person's data in under 10 minutes.
03 You can show, for each purpose, the categories of data, the recipients, the legal basis and the retention period your policy publishes (art. 14 ter, letter d).
04 There are auditable access logs that the administrator cannot modify.
05 You have retention policies configured and automated per data category.
06 If there is a security breach, you know how quickly you would notify the APDP and whom.
07 You know which external providers receive your clients' data and signed a DPA with each.
08 Your system automatically blocks processing when the subject revoked consent.
09 You can respond to an ARCO+ request within the legal timeframe without new development.
10 If the person who knows the system best leaves, someone else can demonstrate compliance to the APDP.

§ What to do with the answers

Every “no” is a concrete place to look. Nearly all of them depend on knowing where the data lives, so starting there uncovers several at once.

These are questions about what your system can do today. Answering “yes” is not enough on its own, because what the authority examines is the evidence. The person who can tell you where you stand is a lawyer looking at your case with the documents in hand.

If software is being built for you now: what to require

§ Clauses and deliverables

01 Data model that separates personal from operational data.
02 API or panel for consent management.
03 API for ARCO+ rights.
04 Exportable immutable logs.
05 A deliverable processing inventory, the basis of the published policy of art. 14 ter, letter d.
06 DPA signed with each identified subprocessor.
07 Documented breach notification procedure.
08 Penetration tests or security audit before go-live.
09 Training for the client team.
10 Update guarantee against regulatory changes.

Five red flags in your SaaS provider

§ Signals not to sign

01 No DPA ready or resistance to sign one.
02 Cannot tell you in which country your data resides.
03 No defined deadline to notify you of breaches.
04 Does not return your data in exportable format if you leave.
05 No access logs available.

§ Cases that already happened

Data breaches are already happening in Chile. In May 2024, CMF and SERNAC formally questioned Banco Santander after a leak with clients in Chile. In November 2025, SERNAC initiated a compensatory procedure against an automotive company for the leak of approximately 392,000 records found on the deep web.

Neither led to fines under Law 21.719 (not in force yet), but they illustrate the risk is real.

Official resources

The difference between complying and not complying is months. The difference between complying well and complying badly is architecture.

If your team is evaluating building or reforming a system with compliance integrated from the architecture, let’s talk. Twenty minutes, no commitment.

§ Modular service

If what you need is the full technical implementation, see the Law 21.719 SME package, the six available technical modules, and the three real systems (BioAudita, tcultura, Nubiq) where we already apply these patterns. Initial audit from 12 UF + VAT. You can also review the honest comparison with other Chilean agencies covering this same scope, including scenarios where choosing them over us makes sense.

Indicative for a base scope, not an offer. Details at /en/pricing.