On December 1, your site’s contact form becomes a legal risk. That sounds like a salesperson’s headline scaring people, so let me start with the reassuring part: it’s not the end of the world and it can be fixed in a couple of afternoons. But it has to be done.<\/p>\n
That day Law 21.719<\/strong> takes full effect, Chile’s new personal data protection law. Here’s the simple version: what applies to you, what your site should have, and what we’re doing about it.<\/p>\n The law was published in December 2024 and replaced Law 19.628, which dated back to 1999 and didn’t enforce anything. What opened then was a two-year window to get up to speed, and that window ends on December 1, 2026<\/strong>.<\/p>\n From that date, the Personal Data Protection Agency is up and running. It can investigate on its own, receive complaints from anyone, order you to stop using the data, issue fines, and publish a registry of sanctioned companies. That registry is public, and for many businesses that part weighs more than the fine.<\/p>\n Everyone. There’s no minimum size or revenue threshold: if you store people’s data, it applies to you just like it does to a bank. What changes is the size of the penalty, not the obligation.<\/p>\n And \u00abpersonal data\u00bb covers a lot more than you’d think. If you have any of these, you’re already processing data:<\/p>\n Sensitive data<\/strong> is a separate case: health, union membership, criminal records, biometrics. The rules there are stricter and require express consent. If your form asks about a medical leave or a workplace accident, you’re in that category even if you didn’t know it.<\/p>\n The law reaches up to 20,000 UTM in the most serious tier \u2014 about CLP 1.434 billion with the September UTM \u2014 and drops to 10,000 and 5,000 UTM in the serious and minor tiers. But those are maximum caps<\/strong>: the Agency grades according to severity, company size, and whether there was intent. A ten-person small business isn’t going to get hit with 1.4 billion.<\/p>\n The real risk is more boring than that. Someone files a complaint \u2014 an angry customer, a former employee, a competitor \u2014 and you have to explain what data you have, where it came from, what you use it for, and who you shared it with. If that isn’t in order, the cost isn’t the fine: it’s putting together in three weeks and in a rush what you could have done calmly in October.<\/p>\n A detail that always gets forgotten: whoever runs your site, hosting, or mailing is a data processor<\/em>, and that relationship should be in writing.<\/p>\n We don’t want to reach December improvising, so we started with our own. We’ve already gone through the sites we manage one by one \u2014 forms, fields they ask for, third-party scripts, privacy policy, cookies \u2014 and every client will receive their diagnosis: what’s missing, ordered by urgency, and the plan to get it up to date before December 1.<\/p>\n We also put together the compliance package: a privacy policy drafted for each company’s real case, consent checkboxes on forms, a banner that blocks scripts until the person accepts, a rights channel, and the data record.<\/p>\n And we started at home: boostify.cl gets up to date first. We’re not going to recommend anything we haven’t tested on our own site.<\/p>\n If you’re a client of ours, for now you don’t have to lift a finger: we’ll come to you with your diagnosis.<\/p>\n First: we’re not lawyers and this isn’t legal advice. Our part is the technical side \u2014 the site, the forms, the scripts, the consents, keeping data in order \u2014 which is where any audit starts. If you handle sensitive data or high volume, add a lawyer to that.<\/p>\n Second: nothing spectacular is going to happen on December 1. The internet won’t go down and no one will show up at your office. It’s just that from that day on, what you didn’t do becomes enforceable and anyone can file a claim. Sorting it out in October costs less and gets done calmly.<\/p>\nWhat it is, in short<\/h2>\n
Who it applies to<\/h2>\n
\n
What’s at stake, without the drama<\/h2>\n
What your site should have<\/h2>\n
\n
What we’re doing at Boostify<\/h2>\n
Three things you can do this week<\/h2>\n
\n
Two honest notes to close<\/h2>\n