{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Claro & Cia., Abogados"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","Chile"]
["Key Legislation Overview"]
["1. What is the key legislation?","The law currently governing data privacy in Chile is \nLaw No. 19.628 on the Protection of Private Life, published on August 28, 1999, as amended, in force until November 30, 2026.\nThe reformed regime is established by \nLaw No. 19.628 as amended by Law No. 21.719, published on December 13, 2024, and entering into force on December 1, 2026, under the title \nLaw on the Protection of Personal Data."]
["2. What are the key decisions applying that legislation?","Under the current law, application is entrusted to the courts and, in some cases, to the National Consumer Bureau (“\nSERNAC”). For example, \nSERNAC has issued several actions against companies in the e-commerce retail industry, requesting them to comply with the above obligations through the publication of a proper Privacy Policy and Cookies Policy which should inform about the existence of data storage files (cookies or other tracking devices) while browsing, the option of rejecting or accepting the use and storage of such files, the purpose of the data storage and processing, and the implementation of a mechanism to object to or refuse the use of the data. \nSERNAC is increasingly monitoring this compliance with privacy regulations in e-commerce websites and digital platforms.\nUnder the reformed law, the Agency for the Protection of Personal Data will have regulatory and enforcement powers.\n"]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?","In the current law, personal data is defined as any information concerning identified or identifiable natural persons, while sensitive data is defined as personal data relating to physical or moral characteristics, or facts or circumstances of private life or intimacy, including personal habits, racial origin, political opinions, religious beliefs, physical or mental health, and sexual life (Article 2(f)-(g)).\nIn the reformed law, personal data is any information linked or referable to an identified or identifiable natural person, and sensitive data includes, in addition to the above, data revealing ethnic or racial origin, political, union or guild affiliation, socioeconomic status, ideological or philosophical convictions, religious beliefs, health data, biological profile, biometric data, sexual orientation, and gender identity (see Article 2(f)-(g)).\n"]
["2. How is the defined data protected?","Under the current law, data must be used only for the purposes for which it was collected, must be accurate and updated, and must be deleted when its storage lacks a legal basis or when it becomes outdated. Sensitive data may not be processed except with legal authorization, the express consent of the data subject, or when necessary for the determination or granting of health benefits (Articles 6, 9, 10).\nThe reformed law establishes a comprehensive set of principles for data processing, including lawfulness, purpose limitation, proportionality, data quality, accountability, security, transparency, and confidentiality. Sensitive data is subject to stricter requirements, including explicit consent and additional safeguards, and the law provides for the rights of access, rectification, erasure, opposition, portability, and blocking (Article 3, and Articles 16, 16 bis, 16 ter).\n"]
["3. Who is subject to privacy obligations?"," According to the current law, any public or private entity that processes personal data in records or databases is subject to privacy obligations, except for data processed in the exercise of freedom of opinion and information (Article 1). \n The reformed law clarifies that it applies to any natural or legal person, including public bodies, that processes personal data, except for personal or family use or journalistic activities. It also provides for its territorial scope of application, establishing that in the following cases its rule may apply: \n \n The data controller or agent is established or incorporated in national territory. \n The agent, regardless of its place of establishment or incorporation, carries out personal data processing operations on behalf of a data controller established or incorporated in national territory. \n The processing of personal data carried out by a data controller who, not being established on national territory, is subject to national law under a contract or international law. \n \n (Articles 1, 1 bis). "]
["4. How is “data processing” defined?","The current law defines data processing as any operation or set of operations or technical procedures, whether automated or not, that allow for the collection, storage, recording, organization, elaboration, selection, extraction, comparison, interconnection, dissociation, communication, transfer, transmission, or cancellation of personal data, or their use in any other form (Article 2(o)).\nThe reformed law defines data processing as any operation or set of operations or technical procedures, whether automated or not, that allow in any way for the collection, processing, storage, communication, transmission, or use of personal data or sets of personal data (see Article 2(o)).\n"]
["5. What are the principles applicable to personal data processing?","While the current law does not explicitly enumerate data protection principles, it requires lawfulness, purpose limitation, accuracy, and confidentiality (see Articles 1, 6, 7, 9).\nThe reformed law expressly sets out the principles of lawfulness and fairness, purpose limitation, proportionality, data quality, accountability, security, transparency and information, and confidentiality (Article 3).\n"]
["6. How is the processing of personal data regulated?"," The regulation of data processing under the current law requires legal authorization or express consent, with exceptions for data from public sources and certain uses (see Article 4). \n Under the reformed law, the general rule of data processing is that the processing of personal data concerning the data subject is lawful when the data subjects give their consent to it. Consent must be free, informed, and specific as to its purpose. Consent must also be given in advance and unequivocally, by means of a verbal, written statement or expressed through an equivalent electronic means, or by an affirmative act clearly indicating the data subject’s intention (Article 12). \n It also establishes the following as other legal bases for data processing, without the consent of the data subject:  \n \n The processing refers to data relating to obligations of an economic, financial, banking, or commercial nature. \n The processing necessary to execute or fulfill a legal obligation or as provided by law. \n The processing of data is necessary to enter into or perform a contract between the data controller and the data subject, or to perform pre-contractual measures at the request of the data subject.  \n The processing of data is necessary for the satisfaction of legitimate interests of the data controller or of a third party, provided that the data subjects´ rights are not affected thereby.  \n The processing of data is necessary for the formulation, exercise, or defense of a right before courts of law or public bodies. \n \n (Article 13). "]
["7. How are storage, security and retention of personal data regulated?","With respect to storage, security, and retention, the current law requires that data be deleted when its storage lacks a legal basis or when it becomes outdated, that it be modified if inaccurate, and that it be kept confidential (see Articles 6, 7, 9).\nThe reformed law requires that data be kept only as long as necessary for the purpose for which it was collected, that it be deleted or anonymized when no longer needed, and that security measures be appropriate to the risk (see Articles 14 quater, 14 quinquies, 14 sexies).\n"]
["8. What are the data subjects' rights under the data legislation?"," The data subjects´ rights under the current law include the right to information, access, modification, deletion, and blocking of data (see Articles 12–16). \n The reformed law expands these rights to include access, rectification, erasure, opposition, portability, and blocking, and provides detailed procedures for their exercise (see Articles 4–10). In particular, it regulates the following data subjects´ rights: \n \n Right of access: the right to obtain from the data controller confirmation as to whether personal data concerning the data subject is being processed, and, where that is the case, access to such personal data and to the information required by law. \n Right to rectification: the right to obtain from the data controller without undue delay the rectification of inaccurate personal data concerning the data subject, and to have incomplete personal data completed, including by means of providing a supplementary statement. \n Right to erasure: the right to obtain from the data controller the erasure of personal data concerning the data subject without undue delay, where one of the grounds provided by law applies. \n Right to oppose: the right to oppose, on grounds relating to the data subject’s particular situation, at any time to the processing of personal data concerning them, including processing for direct marketing purposes. \n Right to data portability: the right to receive the personal data concerning the data subject, which they have provided to a data controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance, where the processing is based on consent or on a contract and carried out by automated means. \n "]
["9. What are the consent requirements for data subjects?","Consent requirements under the current law stipulate that consent must be express and in writing, can be revoked in writing, and must be informed (see Article 4).\nUnder the reformed law, consent must be free, informed, and specific as to its purpose. Consent must also be given in advance and unequivocally, by means of a verbal, written statement or expressed through an equivalent electronic means, or by an affirmative act that clearly shows the data subject’s will (Article 12).\n"]
["10. How is authorization for use of data handled?","Authorization for the use of data under the current law must be in writing and informed and can be revoked (see Article 4).\nThe reformed law requires that authorization (consent) be explicit, prior, and revocable at any time, and also recognizes other legal bases for processing (see Articles 12, 13). \n"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?","The current law does not explicitly regulate cross-border data transfers.\nThe reformed law allows international transfers if the recipient country provides adequate protection, or with appropriate safeguards or in specific cases such as consent, contract, or legal obligation (see Articles 27, 28).\n"]
["12. How are data \"incidents\" and \"breaches\" defined?","The current law does not define or regulate data incidents or breaches.\nThe reformed law defines security breaches as the destruction, leakage, loss, or destruction, leakage, loss, or unauthorized access to or disclosure of personal data (Article 14 sexies).\n"]
["13. Are there any notification requirements for incidents and/or data breaches?","The current law does not impose notification requirements for data breaches.\nThe reformed law requires the data controller to notify the Agency for the Protection of Personal Data and, in some cases, the affected data subjects, without undue delay (Article 14 sexies).\n"]
["14. Who is/are the privacy regulator(s)?","Since there is no data protection authority under current law, courts serve as the competent authority (see Article 16).\nThe reformed law creates the Agency for the Protection of Personal Data as the national data protection authority, with regulatory, supervisory, and enforcement powers (see Articles 30–32).\n"]
["15. What are the consequences of a data breach?","Consequences of a data breach under the current law are not specifically addressed, but general liability for damages applies.\nUnder the reformed law, administrative sanctions, including fines and possible suspension of processing, as well as civil liability for damages, are provided for (see Articles 33–47).\n"]
["16. How is electronic marketing regulated?","Electronic marketing under the current law is regulated by granting data subjects the right to oppose to the use of their data for advertising, market research, or opinion surveys (Article 3).\nThe reformed law grants data subjects the right to object to processing for direct marketing purposes, including profiling (Article 8).\n"]
["17.\tAre there sector-specific or industry-specific privacy requirements?","Neither law contains sector-specific or industry-specific privacy requirements, except that the current law addresses the confidentiality of medical data, and the reformed law provides for special regimes for certain public bodies and sensitive data.\n"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?","There is no requirement to appoint a Data Protection Officer under the current law.\nThe reformed law allows entities to voluntarily appoint a Data Protection Officer as part of a compliance program, and such an appointment is required for certified compliance models (see Articles 49–50).\n"]
["19.\tWhat are the record-keeping and documentation obligations?","The current law does not impose explicit record-keeping or documentation obligations.\nThe reformed law requires data controllers to keep records of processing activities, security incidents, and compliance with the law (see Articles 14, 14 sexies, 49).\n"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?","There is no requirement for Data Protection Impact Assessments under the current law.\nThe reformed law requires such assessments for high-risk processing, including profiling, large-scale processing, monitoring, or processing of sensitive data (see Article 15 ter).\n"]
["21.\tWhat are the requirements for third-party vendor management and data sharing?","Third-party vendor management and data sharing under the current law require that data processing by mandate be in writing and specify the conditions of use (see Article 8).\nThe reformed law requires that processing by third-party processors be governed by contract, specifying the object, duration, purpose, type of data, categories of data subjects, and rights and obligations (see Article 15).\n"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?","Penalties and enforcement mechanisms for non-compliance under the current law include civil liability for damages, fines for certain violations, and judicial remedies (see Articles 16, 23). \nThe reformed law provides for administrative fines of up to 20,000 Monthly Tax Units (Unidades Tributarias Mensuales)\n1 , suspension of processing, publication of sanctions, and civil liability (see Articles 33–53).\n [1] 20,000 Monthly Tax Units (UTM) is equivalent to 1,307,380,000 CLP. At an exchange rate of 0.0011 CLP/USD, this is approximately $1,438,118.00 US Dollars. One UTM is equivalent to 65,369 CLP or approximately $71.91 USD."]
["23.\tWhat are the ongoing compliance and audit requirements?","There are no explicit ongoing compliance or audit requirements under the current law.\nThe reformed law requires entities to implement technical and organizational measures to ensure compliance and allows for voluntary adoption of compliance programs (Articles 48–51).\n"]
["24. Are there any recent developments or expected reforms?","The most significant recent development is the enactment of the reformed law, which will enter into force on December 1, 2026, introducing new rights, obligations, and the creation of a national data protection authority. The current law will remain in force until November 30, 2026, after which the reformed law will fully apply.\n"]