Law 21.719 reaches companies with no establishment in Chile. Article 1 bis letter c) applies it where processing is aimed at offering goods or services to data subjects located in Chile, even free of charge, or at monitoring their behaviour, including analysis, tracking, profiling or behavioural prediction.
The essentials in 30 seconds
- Law 21.719 has extraterritorial scope: it reaches you even if you are outside Chile when you offer goods or services to individuals in Chile or monitor their behavior within the country.
- To transfer data abroad you need a valid mechanism: a country with an adequate level of protection, contractual clauses or binding corporate rules (BCRs).
- There are exceptions (express consent, performance of a contract, public interest), but they do not replace due diligence or documentary evidence.
- The golden rule: inventory flows → assess the destination → choose the mechanism → document and secure.
- Compliance is mandatory from December 1, 2026; violations can reach 20,000 UTM (60,000 with recidivism).
If your company has operations, vendors or users outside Chile, there are two questions you cannot leave unanswered: does Law 21.719 reach you while you are outside the country? and which mechanisms are valid for moving data abroad without falling out of compliance? In this article we answer both in a practical way, with operational steps and a ready-to-use checklist. For an overview of the regulation, see our definitive guide to Law 21.719. If you want the full picture, start with our guide to the data protection law in Chile.
1) Executive summary
Law 21.719 modernizes data protection in Chile, creates the Personal Data Protection Agency, and compliance is mandatory from December 1, 2026 (it was published on December 13, 2024, with a 24-month adjustment period). It aligns principles and obligations with frameworks such as the GDPR, requires proactive accountability, transparency, and security, and specifically regulates international transfers of personal data.
For companies with operations, vendors, or users outside Chile, two issues are critical: extraterritorial scope (when the law applies if you are outside Chile) and the valid mechanisms for transferring data to other countries. If you come from the European world, it helps to review the differences between Law 21.719 and the GDPR.
2) Territorial scope and extraterritoriality
The law applies to controllers or processors established in Chile and also, on an extraterritorial basis, to those who, while located abroad, process data of individuals who are in Chile, when they offer goods or services to those individuals or monitor their behavior within the country. In practice, if you direct your service to users in Chile or process the data of Chileans in that context, the law reaches you even if you are based abroad.
Operational consequence: if your headquarters are outside Chile but you acquire customers in Chile, you must map which processing activities are carried out with respect to individuals in Chile, identify the legal basis, and align your contracts and policies with Law 21.719.
| Situation | Rule | Article |
|---|---|---|
| Controller or agent established in Chile | The law applies with no further requirement. | Article 1 bis letter a) |
| Agent abroad processing on behalf of a Chilean controller | The law applies regardless of where the agent is established. | Article 1 bis letter b) |
| Foreign company offering goods or services to people in Chile | The law applies even where no payment is required from those data subjects. | Article 1 bis letter c) |
| Foreign company monitoring the behaviour of people in Chile | The law applies, including analysis, tracking, profiling or behavioural prediction. | Article 1 bis letter c) |
| Duty of a controller without a Chilean domicile | Designate and keep updated and operational an email or other suitable contact channel for data subjects and the Agency. | Article 14 final paragraph |
| Legal entity not incorporated in Chile | Designate in writing before the Agency a person able to act on its behalf for rights requests and notifications. | Article 10 |
| Transfer to a country with an adequate level | Lawful, under the adequacy determination of article 28. | Article 27 letter a) |
| Transfer covered by contractual clauses or binding corporate rules | Lawful where those instruments establish adequate safeguards. | Article 27 letter b) |
| Transfer with a compliance model or certification | Lawful where both ends adopt it and it establishes adequate safeguards. | Article 27 letter c) |
| Specific, non-routine transfer without adequacy or safeguards | Only in eight listed situations, including express consent for that specific transfer. | Article 27 second paragraph |
3) International transfers: conditions and mechanisms
Law 21.719 permits transferring personal data outside Chile when the destination meets conditions that ensure an adequate level of protection. Typical mechanisms include:
- Countries with an adequate level of protection, recognized by the authority.
- Contractual clauses that ensure equivalent rights and safeguards.
- Binding corporate rules for corporate groups (BCRs).
- Other instruments that the Agency or future regulation may specify.
Practical recommendation: before transferring, assess the legal framework of the recipient country, the vendor's role, the technical safeguards (encryption, access control, segregation), and document the decision.
The list of countries with an adequate level of protection and the standard clause models will be specified by the Personal Data Protection Agency through subsequent regulation. In the meantime, prioritize robust contractual mechanisms and keep the flexibility to incorporate the instruments the authority defines.
4) Exceptions that enable a transfer
In addition to the mechanisms above, the law provides for situations that allow a transfer without going through an "adequate country" or standard clauses, for example:
- Express consent from the data subject, informed of the risks.
- Performance of a contract with the data subject or pre-contractual measures at their request.
- Public interest or compliance with obligations arising from international treaties.
These exceptions do not replace due diligence: you must assess proportionality, necessity, and mitigation measures, and maintain a documentary trail.
5) Operational steps to comply when transfers are involved
- Inventory and data map. Identify which personal data leaves Chile, for what purposes, to which countries, and with which vendors.
- Legal basis and minimization. Verify that the processing has a lawful basis and that you transfer only what is necessary.
- Assess the destination. Review the regulatory framework of the recipient country, security controls, and the vendor's track record.
- Select the mechanism. Adequacy, contractual clauses, BCRs, or another valid safeguard; include security and incident-notification clauses.
- Transparency. Update the privacy policy: purposes, legal basis, third parties, countries, and data subject rights.
- Security. Encryption in transit and at rest, access control, vulnerability management, testing, and audits.
- Records and evidence. Maintain a ROPA / record of processing activities, assessments, and contracts; this demonstrates accountability.
- Incident protocol. Define how to assess, mitigate, and notify breaches affecting transferred data.
6) What to review in contracts with vendors (processors)
- Purpose and obligation to follow instructions. The processor will only process data according to your documented instructions.
- Security measures. Minimum standards, encryption, access controls, logging, and auditing.
- Sub-processors. Conditions for their use and an up-to-date list of sub-processors.
- Locations. Countries where data is stored or accessed.
- Incidents. Notification timelines "without undue delay," minimum content, and cooperation.
- Return or deletion. Upon termination of the service, verifiable return or erasure.
7) Interaction with the GDPR and other regulations
If you already comply with the GDPR or LGPD, you will have a head start: principles, records, DPIAs, transparency, and security are convergent. Even so, review the local nuances of Law 21.719 (definitions, rights, sanctions, and the role of the Agency) and adapt your texts and procedures to the Chilean terms. We analyze the differences point by point in Law 21.719 vs. the GDPR.
8) Breach notification when transfers are involved
If a breach affects data that has been transferred or is located abroad, assess the risk to data subjects in Chile. If the threshold is met, you must notify the authority and, where applicable, the affected individuals. Plan for contractual coordination to receive alerts from the vendor in time so you can meet the obligation to report without undue delay.
9) Quick checklist (international transfer)
- Have you identified the data, purposes, countries, and vendors involved?
- Have you confirmed the legal basis and minimization?
- Have you assessed the recipient country's framework and the safeguards?
- Do you have contractual clauses or BCRs in place where there is no "adequacy"?
- Have you updated the privacy policy and the record of processing activities?
- Can you demonstrate security proportionate to the risk (encryption, access, auditing)?
- Is there an incident protocol with timelines and minimum content?
Do you transfer data outside Chile?
We help you map international flows, choose the right mechanism, and have the evidence ready. A 30-minute assessment.
Schedule an assessmentFrequently asked questions
Does Law 21.719 apply to me if I am outside Chile?
Yes, if you offer goods or services to individuals who are in Chile or monitor their behavior within the country. In that case, you must comply with respect to the processing carried out on individuals in Chile, even if your headquarters are abroad.
Can I transfer data to any country if I have consent?
Express consent may enable the transfer, but you must inform the data subject of the risks and maintain security measures and documentary evidence. It is always advisable to assess whether more robust mechanisms exist, such as countries with an adequate level of protection, contractual clauses or binding corporate rules (BCRs).
What sanctions apply for non-compliance with Law 21.719?
Violations are classified as minor (up to 5,000 UTM), serious (up to 10,000 UTM) and most serious (up to 20,000 UTM). In case of recidivism the fine can be tripled—up to 60,000 UTM—or a percentage of annual revenue from sales and services in Chile (2% for serious recidivism and 4% for most-serious) for companies that are not small businesses, in addition to corrective measures and reputational exposure. We detail the full regime in Fines and sanctions under Law 21.719.
How do I reflect international transfers in my privacy policy?
Include purposes, legal basis, data categories, third parties, countries or the criteria for determining them, retention periods, rights and contact channels. If you use cloud vendors, identify their role and the safeguards applied to the transfer.
Does Law 21.719 apply to companies with no office in Chile?
Yes. Article 1 bis letter c) of Law 21.719 applies it where the controller or agent is not established in the national territory but its operations are aimed at offering goods or services to data subjects located in Chile, or at monitoring the behaviour of data subjects located in the country.
Does it matter whether the service is free?
No. Article 1 bis letter c) of Law 21.719 applies the law to offering goods or services to data subjects in Chile "regardless of whether payment is required of them". A free app, a freemium service or no-cost content are equally covered.
What counts as monitoring behaviour?
Article 1 bis letter c) of Law 21.719 defines it broadly: it includes the analysis, tracking, profiling or prediction of the behaviour of data subjects located in the national territory. Product analytics, behaviour-based advertising and scoring all fall within that description.
What must a covered foreign company do?
Article 14 of Law 21.719 requires a controller without a Chilean domicile to designate and keep updated and operational an email address or other suitable contact channel for receiving communications from data subjects and from the Agency. Article 10 adds a written designation before the Agency.
How is an international data transfer authorised?
Article 27 of Law 21.719 recognises three general routes: transferring to a country with adequate levels of protection; covering it with contractual clauses, binding corporate rules or other instruments providing adequate safeguards; or both parties adopting a compliance model or certification mechanism carrying those safeguards.
Can I transfer data without any of those routes?
Only on a specific, non-routine basis, and in the situations listed in the second paragraph of article 27 of Law 21.719: express consent for that specific transfer, specific banking or stock-market transfers, ratified international treaties, agreements between public bodies, express statutory authorisation, international judicial cooperation, performance of a contract with the data subject, and urgent medical or health measures.
Official sources
- Law 21.719 on the protection and processing of personal data, creating the Personal Data Protection Agency — official text, Library of the National Congress of Chile
- Article 1 bis (territorial scope) and articles 27 and 28 (international data transfers) — consolidated text in force from 1 December 2026
This article is for information purposes only and does not constitute legal advice for a specific case.