Law 21.719 Summary: Effective Date, Fines and Postponement (2026)

Waiting for the postponement of Law 21.719 is the most expensive bet your SME can make. And I get the temptation: the Senate has already approved pushing it to October 15, 2027, the bill is moving under the highest urgency level there is, and you think «if they give me ten more months, why rush?»

Here’s the summary of the law as it stands at the end of October 2026, where the postponement stands, and why it’s not worth sitting around waiting for it.

Law 21.719 in summary

What it is: Chile’s new personal data protection law. It almost entirely rewrites Law 19.628 of 1999.
From when: December 1, 2026. It was published on December 13, 2024, with a 24-month window.
Who it applies to: any company that processes personal data, regardless of size. If you have a contact form, a customer spreadsheet or a WhatsApp broadcast list, you’re in.
The golden rule: to use data you need the person’s consent or another legal basis, and the burden of proving it is yours.
The rights: access, rectification, deletion, objection, portability and blocking. You have 30 calendar days to respond.
The regulator: the new Personal Data Protection Agency, which investigates, fines and publishes sanctions in a national registry.
The fines: up to 5,000, 10,000 or 20,000 UTM depending on severity.

The long version, with the articles and what each one means, is in our complete guide to Law 21.719.

Is it postponed to 2027? Where the bill stands

On September 1 the Executive submitted bill 18.623-07 to the Senate. It does two things: it postpones the entry into force and expands the Agency’s board from three to five members. The Government proposed December 1, 2027.

What happened in October: the Constitution Committee approved it in general unanimously, the Government raised the urgency to «immediate discussion» and, on October 26, the committee approved it in particular with a new date: October 15, 2027. The next day the Finance Committee cleared it without changes, and on October 28 the Senate floor approved it with that same text.

What’s left: the Chamber of Deputies, where the bill has been since October 29, and publication in the Official Gazette. All before December 1. It’s doable, but the calendar is tight: if the Chamber changes the text, it goes back to the Senate.

Until it’s published, the legal date is still December 1, 2026. We follow the bill daily and keep the status up to date in Is Law 21.719 postponed to 2027?.

Why waiting for the postponement is a bad bet

If it doesn’t make it, it applies anyway. And it catches you with nothing done.
The postponement doesn’t touch a single obligation. The Senate itself explains it this way: it moves the date «without modifying its substantive obligations.» The work is the same, today or in a year.
The bill changes along the way. The Government proposed that during the first year all companies receive a warning instead of a fine. The committee removed it: that treatment remains only for smaller companies. What enters Congress doesn’t always come out the same.
The visible part gets fixed fast. Privacy policy, forms and analytics can be put in order in a couple of weeks. There’s no reason to leave it for September 2027.

How much it can cost, in pesos

With the October 2026 UTM ($72,151), the caps look like this:

Minor infringement (not publishing your data policy, not having a channel for requests, responding late): warning or up to 5,000 UTM, around $360 million.
Serious (using data without a legal basis or for another purpose, insufficient security, not reporting a data breach): up to 10,000 UTM, around $721 million.
Very serious (fraudulent processing or malicious use): up to 20,000 UTM, more than $1,443 million.

These are caps, and the Agency graduates them according to the damage, the size of the company and mitigating factors. For SMEs there’s some relief: during the first year the sanction can be a written warning instead of a fine. But it goes into a public registry, and in front of your customers that weighs almost the same.

A field note

In September we audited 20 Chilean websites from the outside, the way a regulator would. 19 had no published privacy policy, or the link was broken. It’s not that they’re careless companies: until now nobody was checking. That’s exactly what changes.

What I would do this week

Take the Law 21.719 self-assessment: ten questions, two minutes, no data left behind.
Open your site and look for the privacy policy. If it’s not there, if it still cites Law 19.628 or if it doesn’t say who the controller is with company name and RUT, that’s the first fix. Here’s the checklist for websites.
Review your forms: they should say what you’ll use the data for, and the newsletter or advertising subscription should be a separate, unchecked box.
Write down where your customers’ data lives today: site, email, spreadsheets, CRM, WhatsApp. Without that map, nothing else can be put in order.

If you already read our September post, Law 21.719: what your company must do before December, this is the update: the plan is the same. The only thing that changed is the noise about the date.