The new regulation will have a term of 24 months for its entry into force.
On December 13, 2024, the Executive published in the Official Gazette Law No. 21,719, which amends, among others, Law No. 19,628, and which regulates the protection and processing of personal data and creates the Personal Data Protection Agency.
It is important to mention that this law substantially modifies the current law governing the matter (Law No. 19,628), raising standards, obligations, rights and sanctions in accordance with the best comparative regulations.
It also modifies some norms of Law No. 20.285 on Access to Public Information, and Law No. 19.496 which establishes norms on Protection of Consumers’ Rights.
The law will enter into force as indicated in the new regulation “shall enter into force on the first day of the twenty-fourth month following the publication of this law in the Official Gazette”.
This date defines several milestones that must be met within the following deadlines:
- Dictation of the Regulations of the Law (until june 13, 2025)
- First appointment of directors, chairman and vice-chairman of the Board of Directors of the Agency (from october 2 to november 30, 2026)
- Elimination of the registry of personal data banks (from october 2 to november 30, 2026)
- Entry into force of the Law (december 1, 2026)
- Proposal of the Agency’s bylaws (until march 1, 2027)
- Sanctioning white march for smaller companies (until december 1, 2027)
- Dictation of policies, norms and instructions for the National Congress, Judiciary and public agencies endowed with constitutional autonomy (until june 1, 2028)
What changes does the new law propose?
There is no doubt that the changes of the new regulation are significant:
- Creation of a Personal Data Protection Agency.
- New bases of lawfulness that enable the processing of personal data, in addition to the current ones (law and consent).
- Express principles regulating data processing.
- Clear obligations and duties for data controllers and data processors.
- Strengthened rights of data subjects: in addition to the rights of access, rectification, erasure, blocking and objection, there is the right of portability and the right to object to decisions based on the automated processing of personal data.
- Regulation of the processing of special categories of personal data (data of children and adolescents, health, biometric, among others).
- Regulation of international data transfers.
- Incorporation of a new data protection compliance to the existing ecosystem.
- Classification of infractions into minor, serious and very serious.
- Sanctions associated with the type of infraction, ranging from a written warning to fines of up to US$1.3M, plus other accessories, with the possibility of an increase in the case of repeat offenses
For more information on the operation and deadlines of the new law, please contact:
Rodrigo Albagli | Partner | ralbagli@az.cl
Eugenio Gormáz | Partner | egormaz@az.cl
Ivonne Bueno | Director az Tech | ibueno@az.cl
Yoab Bitran | Director Compliance Group | ybitran@az.cl
Antonia Nudman | Senior Associate | anudman@az.cl
Be part of our multimedia platform and you can receive the latest legal news, events, podcazt and webinars.
