Regulations › Rest of world › Chile
LPVP
Law 19,628 on the Protection of Private Life, as amended by Law 21,719
WhenIn effect since 28 August 1999
Who enforces itAgencia de Protección de Datos Personales (from 1 Dec 2026; civil courts enforce until then)
Who it applies toPublic and private bodies that process personal data in Chile.
Tell the regulatorNo breach notification duty in the current text
DPO requiredNot addressed
RegistrationNo registration for private controllers
Transfers abroadNo international transfer restriction in the current text
Request deadlineController must respond within 2 business days, otherwise the holder may go to the civil court
Maximum fineCourt-imposed fines of 1 to 10 UTM, or 10 to 50 UTM for economic, financial and commercial dat…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
0
No extraterritorial provision in the current text.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. The reformed law adds extraterritorial reach (not scored).
Lawful basis
3
Processing only when a law authorizes it or the holder expressly consents; narrow exceptions for public-source and certain internal data. No legitimate interests.Art. 4 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Law 21,719 adds further bases including legitimate interest.
Consent
3
Consent must be express, informed about purpose and possible disclosure, and recorded in writing; revocation also in writing.Art. 4 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Sensitive data
2
Sensitive data cannot be processed unless a law authorizes it, the holder consents, or it is needed to grant health benefits.Art. 10 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Children
0
No child-specific rule or age threshold in the current text.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Law 21,719 adds rules for children's data (not reviewed).
People's rights
Rights
2
Information (access), modification, deletion and blocking; opposition to use for advertising, market research or surveys.Arts. 3, 12 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. No portability or automated-decision right until the reform.
Request deadline
3
Controller must respond within 2 business days, otherwise the holder may go to the civil court.Art. 16 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Marketing
1
Holders may object to use of their data for advertising, market research or opinion surveys (opt-out).Art. 3 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Consumer Protection Law 19,496 also regulates promotional messages (not reviewed).
Governance
DPO required
–
Not addressedNot addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Decree 662 (2025) on voluntary compliance models under Law 21,719 provides for a prevention delegate.
DPO qualifications
–
Not addressedNot addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Registration
0
No registration for private controllers; the Civil Registry keeps a registry of public bodies' databases.Art. 22 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Law 21,719 directed the Civil Registry to delete this registry.
DPIA
0
No DPIA requirement in the current text.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Records
0
No records-of-processing requirement in the current text.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Retention
1
Data must be deleted or cancelled when storage lacks a legal basis or the data has expired.Art. 6 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Breaches
Tell the regulator
0
No breach notification duty in the current text.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Sectoral cyber-incident rules may apply separately.
Tell people
0
No duty to notify individuals in the current text.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Transfers
Transfers abroad
0
No international transfer restriction in the current text.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Law 21,719 adds transfer rules.
Localization
0
No data localization requirement.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Enforcement
Maximum fine
1
Court-imposed fines of 1 to 10 UTM, or 10 to 50 UTM for economic, financial and commercial data (about USD 3,500 at most).Art. 16 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026. Under Law 21,719 fines reach 20,000 UTM (about USD 1.4m) per Carey.
Criminal liability
0
No criminal offenses in the data protection law.Not addressed · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Private action
2
Controller must compensate material and moral damage from improper processing; amount set by the judge.Art. 23 · secondary source · source ↗
Pre-reform Law 19,628 text in force on 18 Oct 2026. Law 21,719 (published 13 Dec 2024) rewrites it from 1 Dec 2026.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws