A European customer sends over a supplier questionnaire. Question 14 asks: "Does your company comply with the GDPR?" The IT manager forwards it to legal, legal sends it back asking whether that even applies in Chile, and the questionnaire sits unanswered for three weeks.
If your team searched for "GDPR data protection in Chile" to settle that question, here's the short answer: a company operating in Chile is bound by Law 21.719, not by the European regulation. The GDPR may apply on top of that, but only in specific cases, and which case you're in decides what you have to do and by when.
Why everyone says GDPR
The EU's General Data Protection Regulation (Regulation 2016/679) has been the global reference for years. Software vendors cite it in their contracts, security questionnaires use it as a template, and much of what's written about privacy assumes it.
In Chile, Law 21.719 overhauled the old Law 19.628 from 1999 and borrowed heavily from the European model: legal bases for processing, data subject rights, and a supervisory authority with the power to sanction. That's why you often hear that "Chile adopted the GDPR." It's a shortcut that can get expensive, because deadlines, fines and several day-to-day obligations are not the same.
Which law applies to you
The useful question is what data your company processes, and whose. This table covers the most common situations:
| Your company's situation | Law 21.719 | GDPR |
|---|---|---|
| Operates in Chile with customers and employees in Chile | Yes | No |
| Sells online to people in the EU (prices in euros, shipping to Europe) | Yes | Probably yes (Art. 3(2)) |
| Tracks or profiles users located in the EU | Yes | Yes (Art. 3(2)) |
| Supplies a European company and processes data on its behalf | Yes | Indirectly, through the contract with that customer |
| Has a subsidiary or branch established in the EU | Yes | Yes, for that operation |
Few people mention that Law 21.719 also reaches beyond Chile's borders. Its Article 1 bis applies to controllers not established in Chile when they offer goods or services to people in Chile or monitor their behavior here. It's the same test as GDPR Article 3(2), seen from the other side.
If the GDPR does apply and your company has no presence in the Union, Article 27 requires you to appoint a representative in the EU. There's an exception for occasional, low-risk processing, but have a lawyer who practices European law look at it.
Where they overlap
If your company has already done serious GDPR work, much of it carries over to the Chilean law. Both share the same structure:
- Legal bases for processing. In Chile consent is the general rule, and the law also accepts legal obligation, performance of a contract, legitimate interest, and the exercise of rights before courts (Art. 12).
- Data subject rights: access, rectification, erasure, objection and portability. Portability is new in Chile and requires handing over data in a structured, commonly used format (Art. 16 ter).
- A duty to report security breaches to the authority when there's a reasonable risk to data subjects (Art. 14 sexies).
- A specialized authority that supervises and sanctions. In Chile that will be the Personal Data Protection Agency.
Where they differ
When someone copies a European compliance program and applies it unchanged in Chile, this is where things break:
| Topic | Law 21.719 (Chile) | GDPR (EU) |
|---|---|---|
| Breach notification | "Without undue delay", no deadline in hours | Without undue delay and, where feasible, within 72 hours (Art. 33) |
| Data protection officer | Voluntary; part of the infringement prevention model (Arts. 49 ff.) | Mandatory in some cases: public bodies, large-scale systematic monitoring, large-scale sensitive data (Art. 37) |
| Fines | Up to 5,000, 10,000 and 20,000 UTM depending on severity (Art. 35) | Up to €20 million or 4% of worldwide turnover, whichever is higher (Art. 83(5)) |
| Revenue-based caps | 2% or 4% of annual revenue, only for repeat serious or very serious infringements by companies that aren't small businesses | Applies from the first infringement |
| Authority | Personal Data Protection Agency | The supervisory authority of each member state |
If you work with Europe, there's one more thing. Chile is not currently on the European Commission's list of adequacy decisions, which does include Argentina, Uruguay and Brazil. In practice, a European company sending data to a Chilean supplier needs another mechanism, usually standard contractual clauses, and those clauses put obligations on the supplier.
The date: December 1, 2026, with a delay bill pending
Law 21.719 takes full effect on December 1, 2026. On September 1, 2026 the government sent the Senate a bill moving that to December 1, 2027, mainly because the Agency hasn't been set up yet. As of this writing the bill is still being debated and has not been passed or published, so the December 2026 date stands.
We think pausing compliance work while waiting for the extension is a bad bet. If the bill passes, the extra year lets you finish without rushing. If it doesn't, the deadline is seven weeks away. You can check the latest status in our regulatory notice.
What to do this week
You don't need a six-month project to get out of the fog. These steps stop the back-and-forth between IT and legal:
- Map where the people whose data you process are located. If they're all in Chile, your focus is Law 21.719.
- Check whether you sell, ship or run targeted marketing to people in the EU, or analyze their online behavior. That's where the GDPR can come in.
- List your European customers and the data processing agreements you signed with them. Whatever you promised in those clauses already binds you.
- Build your record of processing activities. It works for both laws and everything else rests on it.
- Review your systems, not just your policies. Production data copied into test environments is a common finding, as we explain in Real data in test environments and Law 21.719. And if your company manages DS 44, that system also stores sensitive employee data; we cover it in this article.
With that in hand you can answer the European customer's questionnaire precisely: which law applies, why, and what measures you have in place.
Frequently asked questions
If I comply with the GDPR, do I automatically comply with Law 21.719?
Not entirely. The foundation is similar and much of the work can be reused, but deadlines, sanctions, the authority and procedures for data subjects differ. Your program needs to be checked against the Chilean law.
Does a Chilean SME that only sells in Chile need to worry about the GDPR?
Generally not. If it doesn't offer goods or services to people in the EU or monitor their behavior, the GDPR doesn't apply. Law 21.719 does, including to small businesses.
Is appointing a data protection officer mandatory in Chile?
No. Under Law 21.719 it's voluntary, although the role is part of the infringement prevention model the law regulates. Under the GDPR it is mandatory in some cases.
Knowing which law applies settles the conversation, but it tells you nothing about the actual state of your applications and databases. That's the part Disrupsoft works on: preparing the organization, assessing the systems technically and fixing them. You can start with our Law 21.719 assessment: twelve questions, an immediate result by area, and no contact details required.
