Chile’s Law 21.719: what changes for a company that does marketing

Chile’s new personal-data law comes into force on 1 December 2026. What it requires, what the fines are, and which of its eight obligations get decided in your forms, your CRM and your ad platforms.

On 1 December 2026, Chile’s Law No. 21.719 comes into general force. It modernises the personal-data regime established by Law No. 19.628 and creates the Personal Data Protection Agency, the body that supervises and sanctions non-compliance. If your company runs digital marketing, that date reaches you sooner than it looks: forms, CRM, custom audiences and automations are, almost all of them, processing of personal data.

This article is not legal advice. It is the operational translation of what the law requires from the systems we work in every day. For an analysis of how it applies to your company, talk to a lawyer.

What actually changes

The substantive change is not one particular new obligation — it is the compliance model. The law is built on proactive responsibility, or accountability: complying is not enough, the company has to be able to demonstrate it through policies, procedures, records and objective evidence.

That distinction orders everything else. A company can be processing data reasonably and still fail to comply, simply because it has no way to prove it. In marketing that shows up fast: almost nobody keeps evidence of how a database was built, and that database is the one feeding the campaigns.

Any organisation that processes information linked to natural persons is covered: customers, workers, suppliers or users. What changes with company size is how proportionate the measures need to be, not whether they apply.

Sanctions are graduated by the severity of the infringement:

• Minor infringements: fines of up to 5,000 UTM.
• Serious infringements: fines of up to 10,000 UTM.
• Very serious infringements: fines of up to 20,000 UTM.

On top of that: corrective measures, cessation of processing operations, court actions by data subjects, compensation and reputational damage. We deliberately leave the amounts in UTM — Chile’s inflation-indexed unit — because converting them to pesos makes them stale the following month.

The eight obligations, and the four that hit marketing

The law is organised around eight core obligations:

All eight apply to the company as a whole. But if your marketing runs on forms, CRM, email and advertising platforms, four of them get resolved — or broken — right there: 1 (knowing what data you hold and where it came from), 2 (the legal basis you process it on), 3 (what your form says before anyone fills it in) and 6 (what you signed with the platforms and agencies that touch it).

Your forms: consent is not the only lawful basis

The most common mistake is assuming everything is solved by asking for consent. The law recognises four lawful bases — the data subject’s consent, performance of a contract, compliance with a legal obligation, and legitimate interest — and a large share of employment and billing processing rests on contract or legal obligation, not consent.

Where consent is the right basis, the requirements are concrete:

• No pre-ticked boxes.
• Evidence of the authorisation, not just the claim that it happened.
• Simple withdrawal: taking consent back has to cost what giving it cost.

And where legitimate interest is invoked, a balancing analysis has to be carried out and documented beforehand. It is not a box you tick: it is a document justifying why the company’s interest does not override the individual’s rights.

Translated to what is on your screen: every form on your site should be able to answer three questions without anyone having to investigate. What data it asks for, what for, and on what legal basis. If the form feeds a custom audience on an advertising platform, that purpose has to be disclosed too.

Your CRM and ad platforms are vendors

Obligation 6 is the one that usually catches people out. Vendors that access or process data on your company’s behalf — cloud, HR software, CRM, marketing tools, call centres, technical support — need a Data Processing Agreement (DPA) built into the contract.

That agreement has to cover, as a minimum:

1. Subject matter and duration of the processing.
2. Authorised purposes.
3. The controller’s instructions.
4. Confidentiality.
5. Security measures.
6. Subcontracting.
7. Incident management.
8. International transfers.
9. Return or deletion of the data when the service ends.

That last point is the one almost nobody has settled. When a relationship with an agency ends or a tool is replaced, the data is rarely returned or deleted: it stays. And you have to check whether any vendor stores or processes data outside Chile, because that is an international transfer and it has to be disclosed in the privacy policy.

Incidents: the 72-hour clock

A company must notify the Data Protection Agency within 72 hours of becoming aware of an incident, where that incident could cause significant harm to data subjects.

Seventy-two hours is not enough time to improvise a procedure. What is needed comes earlier: named owners, an internal channel so someone can raise the alarm, and an incident register that exists even if nothing has ever happened. The same goes for ARSOP-B rights — access, rectification, erasure, objection, portability and blocking: the channel and the procedure have to be live from day one of the law, not from the first request.

Where to start if you have not started

Adapting can be done gradually and proportionately, prioritising the highest-risk processing. If you are starting from zero and your world is marketing, this order gets you furthest:

1. Name someone. One person to coordinate, even if it is not their only job. Without an owner, nothing moves.
2. Map what data you hold. Forms, spreadsheets, CRM, platforms, email lists, audiences. Where each list came from and what for. This is the processing inventory, and it feeds everything else.
3. Assign a legal basis to each one. And document why.
4. Review the forms and the privacy policy. They should say what actually happens to the data, including the third-party platforms it passes through.
5. Review vendor contracts. Starting with the ones that have real access: CRM, email, ad platforms, agency.

None of those five steps requires buying software. They require time and decisions — which is exactly why they are a bad thing to leave for November 2026.

FAQ

• When does Law 21.719 come into force? Its general entry into force is set for 1 December 2026. It modernises the regime established by Law 19.628 and creates the Personal Data Protection Agency, which supervises and sanctions non-compliance.
• Does it apply to a small company? Any organisation that processes information linked to natural persons — customers, workers, suppliers or users — falls under these obligations. What changes with size is the proportionality of the measures, not whether they apply.
• Is consent enough to cover everything? No. There are four lawful bases: consent, performance of a contract, compliance with a legal obligation and legitimate interest. A large share of employment and billing processing rests on contract or legal obligation, not consent.
• What are the fines? Graduated by severity: minor infringements up to 5,000 UTM, serious up to 10,000 UTM and very serious up to 20,000 UTM. On top of that: corrective measures, cessation of processing operations, court actions by data subjects, compensation and reputational damage.