Data governance is the system of roles, policies and controls that defines who is accountable for each piece of data and how its proper use is proven. Chile's Law 21.719 does not require it by that name, but from December 1, 2026 it will require publishing what data is processed, proving the lawfulness of the processing and safeguarding its security.
The essentials in 30 seconds
- Law 21.719 does not mention data governance, nor does it require adopting a reference framework or an ISO standard.
- From December 1, 2026, the law will require outcomes that depend on it: publishing what data you process (art. 14 ter), protecting data by design (art. 14 quáter) and securing it (art. 14 quinquies).
- From December 1, 2026, the company must be able to prove the lawfulness of each processing activity (art. 3 letter a) and, if an incident leads to a dispute, that its security measures existed and worked (art. 14 quinquies).
- The data protection officer (DPO) is voluntary (art. 50), except in the infringement prevention model (art. 49 letter a).
- A data committee, data owners by domain and the record of processing activities (RoPA) are good practice.
Data teams build catalogues, quality rules and committees; compliance teams draft policies for Law 21.719. If they move forward separately, the company pays twice to answer the same questions: what data it holds, where it is, who uses it, what for and until when. If you want the full picture, start with our guide to the data protection law in Chile.
Here you will see which part of data governance the law will require from December 1, 2026, which part is good practice, and an article-by-article checklist. The regulatory sources were reviewed on October 21, 2026.
What is data governance?
Data governance is the set of decisions, roles, policies and controls through which an organization defines who is accountable for each data set, which rules apply to it and how compliance with those rules is verified.
It should be distinguished from data management: governance decides and oversees; management executes. There are industry reference frameworks, such as DAMA-DMBOK, but Chilean law does not require adopting any of them.
The personal data protection law covers narrower ground: information linked or referring to identified or identifiable natural persons (article 2 letter f). Compliance is decided where the two overlap: in personal data.
Does Law 21.719 require data governance?
Not by that name. Neither the law nor Decree 662, which regulates infringement prevention models, uses the term «data governance» («gobierno de datos» or «gobernanza de datos» in Spanish).
From December 1, 2026, the law will require outcomes that cannot be achieved without governance and will place several burdens of proof on the company. The controller «must be able to prove the lawfulness of the processing» (article 3 letter a), will be accountable for compliance with the principles (article 3 letter e) and must take action to prevent infringements (article 48). If a security incident leads to a judicial or administrative dispute, it will be up to the controller to prove that its measures existed and worked (article 14 quinquies).
The law will require the content: the information that must be published, accurate data, retention periods, security measures appropriate to the risk, contracts with processors and impact assessments where applicable. The form is good practice: a data committee, data owners by domain, a catalogue, quality indicators and control frameworks.
Which data governance roles help to comply with the law?
The law assigns most obligations to the data controller (articles 2 letter n and 14) and some also to the processor (article 15 bis), but it does not say which internal area must carry them out. In a large company, it makes sense to allocate them as follows:
- Board of directors or highest authority. Appoints the data protection officer, if there is one (article 50), and should approve the data processing policy.
- Data protection officer (DPO). Voluntary (article 50), except in the prevention model (article 49 letter a). The DPO must have autonomy from management on matters covered by the law, and a business group may share one if its companies operate under the same standards and policies and the DPO is accessible to all of them.
- Data owners by domain. Managers who are accountable for the purpose, the lawful basis and the retention period of their processing activities. The law does not mention them, but they put the accountability principle into practice.
- Technical custodians. IT and security carry out the measures in articles 14 quáter and 14 quinquies and generate the evidence.
- External processors. Suppliers that process data on the company's behalf: from December 1, 2026 they will need a contract with minimum content and, to delegate the engagement, specific written authorization (article 15 bis). Today the law in force only requires the mandate to be recorded in writing, setting out the conditions for using the data.
If the company has a prevention officer or data protection officer, it must identify them in the information it makes available to the public (article 14 ter letter b).
What does the law require on data inventory, quality and lifecycle?
Inventory. Accurately publishing what article 14 ter will require (categories of data, universe of data subjects, recipients, purposes, lawful basis, retention period and source) is not possible without an inventory, even though the law asks for a generic description rather than one processing activity at a time. The law does not call it a record of processing activities (RoPA); Decree 662 allows one to be used within the prevention model (article 3 letter d of the regulation). You can start with the RoPA template.
Quality. From December 1, 2026, processing personal data that is inaccurate, incomplete or out of date in relation to the purposes of the processing will be a serious infringement (article 34 ter letter d), unless updating it is the data subject's responsibility under law or contract.
Lineage. Once data has been rectified, «the unrectified data may not be processed again» (article 6), and changes resulting from rectification, erasure or objection must be communicated to those who received the data (article 11). That requires knowing which systems, subsidiaries and suppliers each piece of data flows to.
Lifecycle. Data may be kept only for as long as necessary for the purpose and must then be erased or anonymized, unless a legal exception applies; a longer period will require legal authorization or the data subject's consent (article 3 letter c). Pseudonymizing is not enough: pseudonymized data can be attributed back to its data subject with additional information, whereas anonymized data ceases to be personal (article 2 letters k and l). More in data retention and deletion.
What should a data governance checklist for Law 21.719 include?
The table maps each component to the legal duty it helps to fulfil and the evidence worth having if the Personal Data Protection Agency asks for it; every mandatory row without evidence is a pending task.
| Component | Duty under the law | Article | Evidence worth having |
|---|---|---|---|
| Inventory and policy | Publish, among other things, the policy with its date and version, the categories of data and of data subjects, purposes, lawful basis, recipients, retention period, source and security measures | 14 ter | An inventory that supports the policy, and a version history |
| Lawful basis | Prove the lawfulness of each processing activity | 3 letter a); 13 | A written analysis for each processing activity |
| Quality | Accurate, complete, up-to-date and relevant data | 3 letter d) | Quality rules and a log of corrections |
| Lineage | Correct the copies in use and communicate the changes to those who received the data | 6; 11 | A data flow map and a record of the communications |
| Retention | Keep only what is necessary; then erase or anonymize, unless a legal exception applies | 3 letter c) | A retention schedule and a record of erasures |
| Privacy by design | Measures from the design stage and, by default, only the strictly necessary data | 14 quáter | A documented review in every project |
| Impact assessment (DPIA) | Carry it out before processing that may result in a high risk, and always in the four cases set out in the law | 15 ter | Assessments dated before processing begins |
| Security | Measures appropriate to the risk, such as encryption, pseudonymization and regular verification of their effectiveness | 14 quinquies | An access matrix and test results |
| Incidents | Report to the Agency without undue delay when there is a reasonable risk to the rights and freedoms of data subjects, record the report and also notify the data subjects if sensitive data, data of children under fourteen or financial data are involved | 14 sexies | A procedure and a register of breaches |
| Processors | A contract with minimum content; delegate the engagement only with specific written authorization | 15 bis | Current contracts and authorizations |
| Data subject rights | Respond within 30 calendar days, extendable once, and keep a record of the response | 11 | A log of requests and a copy of each response |
| DPO and programme | Voluntary; if the prevention model is adopted, the DPO is mandatory | 49; 50 | Minutes of the appointment, an annual plan and a risk matrix |
Not all pending items carry the same weight: failing to carry out an impact assessment when required will be a very serious infringement (article 34 quáter letter k), and breaching the security obligations a serious one (article 34 ter letter j). Check when an impact assessment is required.
How does data governance connect with the infringement prevention model?
The infringement prevention model is a voluntary compliance programme (article 49) and, for a company with data governance in place, a natural extension. The inventory covers the characterization of data and data subjects (letter c); the identification of risky processes (letter d) becomes a risk matrix that takes into account the graduation of the law's sanctions (article 3 letter e of Decree 662), and internal reporting (letter f) may be integrated into existing whistleblowing channels if they comply with the law and the regulation (article 3 letter g of Decree 662). What is added: a mandatory data protection officer, with defined resources and powers (letters a and b), protocols for the risky processes (letter e) and internal sanctions with reporting procedures (letter g). In addition, the internal rules must be incorporated into employment and service contracts, including those of top executives, or into the internal regulations (article 49).
The Agency will certify the model for three years (articles 51 and 52), and that certificate will verify the mitigating factor in article 36 No. 5. It will not be able to do so before December 1, 2026: the power to certify (article 30 bis letter m) and articles 49 to 53 enter into force on that day (first transitory article of Law 21.719), and in the meantime the fourth transitory article limits the Board to letters a), b), g) and h) of article 30 bis and to the functions of article 30 ter. Implementation, on the other hand, can begin before the entity is entered in the register (article 18 of Decree 662). More in the infringement prevention model.
Where should you start before December 1, 2026?
If a data governance programme already exists, it makes sense to extend it to personal data rather than set up a parallel structure:
- Scope: which domains hold personal data and who owns each one.
- Inventory with the fields required by article 14 ter.
- Quality and lineage of the data disclosed or assigned to third parties.
- Retention by category, with scheduled erasure or anonymization.
- Privacy in the project lifecycle, with an impact assessment where required.
- Decision on the data protection officer and the prevention model.
There is a bill to postpone the law which, as of October 20, 2026, was still at its first constitutional stage in the Senate, but it is not law: the legal date is still December 1, 2026. The full picture is in the summary of Law 21.719; our approach, in Law 21.719 implementation for large companies.
Does your data governance already produce the evidence Law 21.719 will require?
In a 30-minute assessment we cross-check your data governance against the duties of the law: what evidence you already have, what gaps remain and whether the infringement prevention model makes sense for you.
Schedule an assessmentFrequently asked questions
What is data governance?
Data governance is the set of roles, policies and controls that defines who is accountable for each data set, which rules apply to it and how compliance is verified. Data management carries out those rules.
Does Law 21.719 require a data governance programme?
Not by that name. But from December 1, 2026 it will require companies to prove the lawfulness of each processing activity (article 3 letter a), to publish what data they process (article 14 ter) and to adopt security measures appropriate to the risk (article 14 quinquies), outcomes that are hard to achieve without data governance.
What is the difference between data governance and personal data protection?
Data governance is a management discipline that covers all of a company's data. Personal data protection is a legal regime that, in Chile, covers only information about identified or identifiable natural persons (article 2 letter f).
Is a record of processing activities (RoPA) mandatory in Chile?
Not as a document by that name. Law 21.719 will require publishing the information in article 14 ter, and a RoPA is an orderly way of keeping it. Decree 662 allows it to be used to characterize processing activities within the infringement prevention model.
Is it mandatory to appoint a data protection officer (DPO)?
No. Article 50 says the controller «may appoint» a data protection officer; if it does, the appointment must be made by the board of directors, a managing partner or the company's highest authority. It will be mandatory if the company adopts the infringement prevention model (article 49 letter a).
Is data quality a legal obligation in Chile?
For personal data, yes: it must be accurate, complete, up to date and relevant in relation to its origin and the purposes of the processing (article 3 letter d). From December 1, 2026, processing it when it is inaccurate, incomplete or out of date in relation to those purposes will be a serious infringement (article 34 ter letter d), unless updating it is the data subject's responsibility under law or contract.
When is an impact assessment mandatory in a data project?
When the processing is likely to result in a high risk to the rights of data subjects, and always in the four cases in article 15 ter, including massive or large-scale processing and the systematic monitoring of a publicly accessible area. It must be carried out before processing begins, and failing to do so will be a very serious infringement (article 34 quáter letter k).
Does an ISO certification replace certification of the prevention model?
No. ISO/IEC 27701:2025 is an international standard for privacy information management systems, and Chilean law does not provide for it as a way of proving compliance. The prevention model will be certified by the Personal Data Protection Agency (article 51), and that certificate will verify the mitigating factor in article 36 No. 5. We explain this in detail in ISO 27701 and Law 21.719.
Official sources
- Law 19.628 consolidated with the amendments of Law 21.719 (in force from December 1, 2026)
- Law 21.719 — text as published, with its transitory provisions, Library of the National Congress
- Decree 662 of the Ministry of Finance, regulation on infringement prevention models
- ISO/IEC 27701:2025 — Privacy information management systems
This article is for information purposes only and does not constitute legal advice for a specific case.