The short answer
Chile's Law 21,719 is due to start on 1 December 2026. It applies to anyone processing personal data in Chile or offering goods or services to, or monitoring, people in Chile. Websites and apps need a privacy notice, a legal basis, working rights requests, security, breach notification and care with children's and sensitive data.
Key takeaways
- Law 21,719 was published on 13 December 2024 and amends Law 19,628. It creates a new Personal Data Protection Agency.
- The law is due in force from 1 December 2026. That date holds until a postponement is published.
- The Senate's records show it approved a government bill (Boletín 18.623-07) on 28 October 2026, and it is now in the Chamber of Deputies. Law firms report the bill moves the start to 15 October 2027; we have not read that date in the bill text.
- It reaches businesses outside Chile that offer goods or services to people in Chile or monitor them.
- The delay bill is reported to change dates and the Agency's governance, not the duties themselves.
On this page
01
When does Chile's data protection law start?
On paper, 1 December 2026. Law 21,719 was published on 13 December 2024, and law-firm updates from September and October 2026 still give 1 December 2026 as the date in force.
| Item | Status |
|---|---|
| Legal start date | 1 December 2026, until a postponement law is published |
| Delay bill | A government bill (Boletín 18.623-07). The Senate approved it on 28 October 2026 and it is now in the Chamber of Deputies (second constitutional stage, urgency renewed). Law firms report the new start as 15 October 2027; we have not read that date in the bill text |
| Still needed | A final Chamber vote, promulgation and publication in the Diario Oficial |
| Official confirmation | Progress is from the Senate's tramitación record (checked 10 November 2026). The 15 October 2027 date comes from law-firm reports, not the bill text |
02
Does Chile's law apply to my website or app?
Yes, if you process personal data in Chile, offer goods or services to people in Chile, or monitor them. A foreign SaaS with Chilean sign-ups is in scope in the same way as a Santiago start-up.
Signals that you are targeting Chile: pricing in Chilean pesos, Spanish copy aimed at Chile, a .cl domain, or Chilean customers in your user list.
03
What must a website or app do under Law 21,719?
The rulebook turns the law into seven duties for a typical site or app:
- 01
A privacy notice at collection
Say who you are and how to reach you, why you use the data, the legal basis, who receives it, how long you keep it, people's rights, their right to complain and any transfers abroad.
- 02
A lawful basis for each use
Often consent, but not always. Match each use of data to a basis and record it.
- 03
Rights people can use
Access, rectification, erasure, objection, portability and blocking, with a clear way to ask. The data export prompt helps with access and portability.
- 04
Reasonable security
Access control, encryption and no exposed keys or open tables. See the security checklist.
- 05
Safeguards for transfers abroad
Transfers outside Chile need the safeguards the law sets. List where your providers process data.
- 06
Breach notification
Tell the Personal Data Protection Agency without undue delay, and tell people as well when sensitive, children's or financial data is involved.
- 07
Sensitive data and children
Sensitive data usually needs explicit consent, and children's data needs a parent's consent.
Article numbers are not given here because we could not read the statute's full text on the official site; the rulebook cites the duties by topic. Confirm details with a Chilean lawyer.
04
How do I check my product for Chile?
- Open your privacy notice and check it names the legal basis for each use of data.
- Check it explains how a person in Chile can see, correct or delete their data.
- Test that an erasure request really deletes the account data.
- Write down your breach plan: who decides, who tells the Agency and who tells users.
Chile is one of 58 markets SafeLaunch checks, alongside 142 laws in total. Choose it in a free scan to see your notice and rights against the rulebook; see the coverage page and this week's briefing. For another large rule change in the same period, read the DPDP checklist.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes plain-English guides to tech, data and AI law.
Read his writingSee what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading