Economic crime
White-collar crime
Criminal advice and defense in economic and corporate crime: internal investigations, criminal complaints, and defense of executives and of the company itself as a legal entity.
Personal data protection
Compliance with Law 21.719 so that your company processes customer, employee and third-party data on clear lawful bases, with proportionate security and documented evidence of compliance.
A new regime, with an authority that enforces it
Law 21.719 replaces the regime of Law 19.628 and brings Chile closer to European data protection standards. It creates the Personal Data Protection Agency, expands data subject rights and sets up a system of infringements and fines.
1 December 2026. The regime becomes fully effective on that date. Bringing a mid-sized organisation into compliance takes months, not weeks.
- Lawful bases
All processing must rely on consent or another legal basis: contract, legal obligation, legitimate interest or others provided by law.
- Expanded rights
Access, rectification, erasure, objection, portability and blocking, plus safeguards against automated decisions.
- Accountability
Complying is not enough: it must be demonstrable through records, policies and documented measures.
- Security and breaches
Technical and organisational measures proportionate to risk, and a duty to report security breaches.
What a company needs to have in place
- InventoryKnow what data you processWhich data, about whom, for what purpose, on what basis, where it is stored and with whom it is shared.
- TransparencyPolicies and noticesClear information for customers, employees and applicants about how their data is processed.
- Third partiesProcessor agreementsSoftware, cloud, payroll or marketing providers that process data on the company's behalf.
- RightsResponse procedureA channel and timelines to handle data subject requests promptly and traceably.
- TransfersData outside ChileAdequate safeguards when data is hosted or transferred abroad.
- RiskImpact assessmentsPrior analysis for high-risk processing, such as large-scale sensitive data or profiling.
- SecurityBreach protocolDetection, containment, recording and reporting of incidents to the Agency and, where applicable, to data subjects.
- GovernanceInfringement prevention modelA compliance program with a data protection officer, eligible for certification.
Our service
Staged compliance with concrete deliverables, prioritised by risk.
-
Assessment
Processing audit
- Mapping of databases and data flows
- Records of processing activities
- Lawful basis analysis
- Identification of sensitive data
- Gap report against Law 21.719
-
Implementation
Regulatory alignment
- Internal and external privacy policies
- Processor clauses and agreements
- Data subject rights procedure
- Security breach protocol
- Training for teams handling data
-
Ongoing
DPO and monitoring
- Outsourced data protection officer
- Updates to records and policies
- Impact assessments for new projects
- Responses to Agency requests
- Artificial intelligence and data use
Infringements and fines
The law classifies infringements by severity. Sanctions are also entered in a national register, with the resulting reputational impact. UTM is the Chilean monthly tax unit.
- Minor infringements
- 5,000 UTM
- Serious infringements
- 10,000 UTM
- Very serious infringements
- 20,000 UTM
Maximum amounts per infringement. In cases of repeat offences, the law allows higher fines, which for larger companies may be calculated on their annual revenue.
Frequently asked questions
When does Law 21.719 take effect?
Law 21.719 was published on 13 December 2024 and its regime becomes fully effective on 1 December 2026. From that date the Personal Data Protection Agency can inspect and impose sanctions.
Does the law apply to small businesses?
Yes. It applies to any person or organisation that processes personal data, regardless of size. Proportionality allows measures to be scaled to the size and risk of the processing, but the core obligations apply to everyone.
Is it mandatory to appoint a data protection officer?
Generally not, but the officer is part of the infringement prevention model that the law allows companies to adopt and certify, which may weigh favourably in sanctioning proceedings.
We already comply with the GDPR. Is that enough?
It is a strong starting point, as Law 21.719 follows many European principles, but it has its own rules on lawful bases, data subject response times, breach reporting, international transfers and sanctions. A targeted gap analysis avoids duplicating work.
What happens if the company suffers a data breach?
The law requires security breaches affecting personal data to be reported to the Agency and, in certain cases, to the data subjects. Having a response protocol in place beforehand reduces both the harm and the sanctioning risk.
Complying with Law 21.719 is a process. Start by knowing where you stand.
An initial assessment shows what is urgent, what can wait and what it will cost to comply. Let's talk.
Other practice areas
Law 20.393 · Compliance
Crime Prevention Model
Design, implementation and updating of corporate Crime Prevention Models under Law 20.393, as amended by the Economic Crimes Law (Law 21.595).
Law 21.643
Ley Karin and employment compliance
Prevention protocols and investigation procedures for workplace harassment, sexual harassment and violence at work required by Law 21.643 (Ley Karin).
Corporate
Corporate law
Company, contract and corporate governance advice as an outsourced legal department: entities, contracts, conflicts of interest and counterparty due diligence.
SMEs
Legal advice for SMEs
Compliance scaled to the real size of the business: assessment, priorities and a work plan with a defined scope and fixed fees.