ISO/IEC 27701 helps organize the management of personal data, but on its own it does not prove compliance with Chile's Law 21.719. The certificate is issued by an external body, not by ISO. The law does not mention the standard and, from December 1, 2026, it will verify the mitigating factor in article 36 No. 5 with the prevention model certificate that the Agency will grant.
The essentials in 30 seconds
- ISO/IEC 27701:2025, published in October 2025, is the second edition of the standard; the 2019 edition has been withdrawn.
- The 2019 edition extended ISO/IEC 27001 and ISO/IEC 27002; the 2025 edition is independent and can be used on its own.
- Neither Law 21.719 nor Decree 662 mentions ISO standards.
- From December 1, 2026, the mitigating factor in article 36 No. 5 will be verified with the Agency's certificate (article 51), not with an ISO one.
- An ISO system is a good foundation for the prevention model, but it does not come with the content of Chilean law.
If your company holds ISO/IEC 27001 or is assessing ISO/IEC 27701, the logical question in light of Law 21.719 is how much of the law is already taken care of. You need to separate the management system, which is useful, from the certificate, to which Chilean law assigns no effect. If you want the full picture, start with our guide to the data protection law in Chile.
Here you will see what the standard is, what changed in 2025, which duties under the law it helps to organize and which certification counts for the mitigating factor. For the general framework, start with the summary of Law 21.719. Sources reviewed on October 21, 2026.
What is ISO 27701 and what changed in the 2025 edition?
ISO/IEC 27701 is an international standard that sets out requirements and guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS). It is aimed at personal data controllers and processors, it is developed by subcommittee ISO/IEC JTC 1/SC 27, the same one behind ISO/IEC 27001, and its text is available only for purchase.
The current edition is ISO/IEC 27701:2025, published in October 2025, which replaced the 2019 edition. The substantive change is its autonomy: the 2019 edition was defined as an extension of ISO/IEC 27001 and ISO/IEC 27002, for those processing data within an information security management system; the 2025 edition, according to ISO, is an independent management system standard that can be used on its own.
| Item | ISO/IEC 27701:2019 | ISO/IEC 27701:2025 |
|---|---|---|
| Edition and publication | First, August 2019 | Second, October 2025 |
| Status | Withdrawn | Published |
| Pages | 66 | 64 |
| Relationship with ISO/IEC 27001 | Extension of ISO/IEC 27001 and ISO/IEC 27002 | Independent standard, aligned with ISO/IEC 27001 |
If your certificate is for the 2019 edition, check with your certification body how to transition and within what timeframe.
How does ISO 27701 relate to ISO 27001?
ISO/IEC 27001:2022 sets out the requirements for an information security management system (ISMS) which, according to ISO, preserves the confidentiality, integrity and availability of information by applying a risk management process. ISO/IEC 27701 targets something else: managing personal data in line with privacy laws.
Law 21.719 draws the same distinction. Security is one of its eight principles (article 3 letter f), but lawfulness, purpose or proportionality require deciding what data is processed, what for and on what basis, and an ISMS does not answer that.
Where an ISMS does pay off is article 14 quinquies, which from December 1, 2026 will require measures that ensure the confidentiality, integrity, availability and resilience of the systems, and lists among them «a process of regular verification, evaluation and assessment» of their effectiveness. In the event of a security incident, and if there is a judicial or administrative dispute, it will be up to the controller to prove that its measures exist and work, and the evidence from a management system helps. The minimum standards, however, will be set by the Agency through a general instruction (article 14 septies). More in the security measures of Law 21.719.
Which Law 21.719 duties does an ISO system help to organize, and which does it not?
An international standard cannot know the deadlines, legal grounds or authorities of a Chilean law; the official ISO/IEC 27701 page cites the GDPR as an example, not Chilean law. A management system provides structure (risk management, continual improvement, evidence), and the legal content has to be built into it.
| Duty | Article | What Chilean law sets out |
|---|---|---|
| Lawfulness of processing | 12 and 13 | Consent or a legal ground; the controller must prove lawfulness. |
| Information and transparency | 14 ter | Twelve minimum items made public, including the basis of legitimacy. |
| Data subject rights | 11 | Thirty calendar days to respond, extendable once. |
| Data protection by design and by default | 14 quáter | Measures from the design stage and, by default, only the strictly necessary data. |
| Security breach reporting | 14 sexies | To the Agency, without undue delay, when there is a reasonable risk to the rights and freedoms of data subjects; also to the data subjects if sensitive data, data of children under fourteen, or economic and financial data are involved. |
| Processors | 15 bis | A contract with minimum content and written authorization to subcontract. |
| Impact assessment (DPIA) | 15 ter | Before processing that may result in a high risk, and always in four cases. |
| International transfers | 27 and 28 | Adequate countries or safeguards with enforceable rights for data subjects, among other cases. |
Each row needs an owner, a procedure and evidence, and a management system handles that well. The content comes from Chile's personal data protection law and from the instructions the Agency issues.
What is the difference between an ISO certificate and the Agency's certification?
They are two different certifications. An ISO certificate is issued by an external certification body: ISO does not certify or issue certificates. The certification body may be accredited by an accreditation body, although ISO makes clear that accreditation is not a requirement.
Certification of the infringement prevention model will be granted by the Personal Data Protection Agency, at the request of the interested party, under articles 49 to 53 of the law and Decree 662 of the Ministry of Finance, published on September 9, 2026. It certifies that the model «meets the requirements and elements established in the law and its regulation» (article 51).
The decisive difference lies in article 36 No. 5: from December 1, 2026, having diligently fulfilled the duties of direction and supervision will be a mitigating factor, which «shall be verified with the certificate issued in accordance with the provisions of article 51». Recital 6 of Decree 662 links the mitigating factor to the adoption of the model, but the law determines how it is verified, and an ISO certificate is not that certificate.
| Aspect | ISO/IEC 27701 certificate | Prevention model certification |
|---|---|---|
| Who certifies | An external certification body; ISO does not certify | The Personal Data Protection Agency (article 51) |
| Nature | A voluntary service from an external certification body | A voluntary administrative procedure, governed by Law 19.880 |
| What it verifies | The requirements of the standard | The elements of the law and the regulation |
| Validity | As stated on the certificate | Three years (article 52), renewable under the regulation |
| Where to check it | With the certification body or in IAF CertSearch | National Register of Sanctions and Compliance, public and free of charge |
| Effect before the Agency | The law assigns it none | Verifies the mitigating factor in article 36 No. 5 |
| Status as of October 21, 2026 | Standard published since October 2025 | Not yet in operation |
The regulation only allows the certification to be publicized «by means of a direct, pure and simple reference» to the National Register of Sanctions and Compliance (article 5 of the regulation). From December 1, 2026, knowingly providing false, incomplete or manifestly erroneous information in the registration or certification process will be a very serious infringement (article 34 quáter letter j of the law). More in what Decree 662 regulates.
The procedure cannot be requested yet: the law enters into force on December 1, 2026, and the decree does not set an effective date of its own. There is a bill to postpone the law at its first constitutional stage in the Senate, and it is not law. Article 18 of the regulation does allow the model to be implemented before it is registered.
Is an ISO system useful for building the infringement prevention model?
Yes, as a foundation, and this is where it pays off most in Chile. Article 49 requires at least seven elements, which article 3 of the regulation develops into ten letters, and a mature management system may already have some of them well under way: data inventory, risk processes, protocols and internal reporting. The regulation even accepts characterizing processing activities «through a record of processing activities».
No ISO certificate proves what is specific to Chilean law:
- A data protection officer appointed in accordance with the law, by the most senior management or administrative authority and with autonomy (article 50), whose suitability must be demonstrable (article 10 of the regulation). Outside the model, the data protection officer is voluntary.
- An infringement risk matrix, with the processes most exposed to the infringements in articles 34 bis, 34 ter and 34 quáter and the graduation of their sanctions (article 3 letter e of the regulation).
- Internal regulation in employment or service contracts, including those of top executives, or in the internal regulations (article 49).
- Internal sanctions and a reporting channel to the data protection officer that allows the identity of the person reporting to be kept confidential (article 3 letters h and i of the regulation).
- Mechanisms for reporting security breaches to the Agency and, where applicable, to data subjects (article 14 sexies), and for self-reporting (article 36 No. 4), under article 49 letter f of the law and article 3 letter g of the regulation.
The seven elements are explained in the infringement prevention model.
Is ISO 27701 certification worth it if your company operates in Chile?
It depends on the objective. ISO presents it as a way to build trust with partners, clients and regulators and to help demonstrate compliance with regulations such as the GDPR. Before the Chilean Agency, the law assigns it no effect.
Nor is it enough, on its own, to transfer data abroad: from December 1, 2026, article 27 letter c) will accept a «compliance model or certification mechanism» only if both the party transferring and the party receiving the data adopt it, and if it establishes adequate safeguards in accordance with article 28, which in particular requires enforceable rights and effective legal remedies for data subjects. A reasonable order for a large company:
- Start with the law, not the standard: inventory, lawful bases, the information required by article 14 ter and the data subject rights procedure.
- Use the existing management system as the backbone for the duties in articles 14 quinquies, 14 sexies and 15 bis.
- Decide on the prevention model at board level: it is voluntary and requires appointing a data protection officer (article 49 letter a). If the Agency certifies it, once the procedure is operational, that certificate will be the one that verifies the mitigating factor (article 36 No. 5).
- Assess ISO/IEC 27701 for its commercial value, knowing that the certificate Chilean law looks at is the Agency's.
In groups with several subsidiaries and certifications, that cross-check is what we work on in the Law 21.719 compliance programme for large companies.
Do you already have ISO 27001 or are you assessing ISO 27701?
In a 30-minute assessment we cross-check your management system against the duties of Law 21.719 and the prevention model: what you have covered, what is missing and what to prioritize before December 1, 2026.
Schedule an assessmentFrequently asked questions
What is ISO 27701?
ISO/IEC 27701 is an international standard that sets out requirements and guidance for a Privacy Information Management System (PIMS). It is aimed at personal data controllers and processors. Its current edition is ISO/IEC 27701:2025, published in October 2025.
What changed in ISO/IEC 27701:2025?
It is the second edition and replaced the 2019 edition, which has been withdrawn. The 2019 edition was an extension of ISO/IEC 27001 and ISO/IEC 27002; the 2025 edition is an independent management system standard that, according to ISO, can be used on its own.
Does Law 21.719 require ISO 27001 or ISO 27701 certification?
No. Neither Law 21.719 nor Decree 662 mentions ISO standards. The law will require security measures appropriate to the risk (article 14 quinquies) and tasks the Agency with setting minimum standards through a general instruction (article 14 septies).
Does an ISO 27701 certificate prove compliance with Chilean law?
Not on its own. It is issued by an external certification body against the requirements of the standard, and Law 21.719 assigns it no effect. Its evidence helps, but compliance is measured against the duties set by the law.
Which certification counts for the mitigating factor in article 36 of Law 21.719?
The infringement prevention model certification that the Agency will grant. Article 36 No. 5 states that diligent fulfilment of the duties of direction and supervision «shall be verified with the certificate» of article 51. An ISO certificate does not serve that purpose.
Can I use my ISO 27001 system as the basis for the prevention model?
Yes. Its risk management and its evidence contribute to the article 49 programme of Law 21.719. You need to add or adapt the elements specific to Chilean law: a data protection officer appointed by the most senior management or administrative authority, an infringement risk matrix, internal regulation in contracts and a reporting channel that keeps the reporter's identity confidential.
Do I have to appoint a data protection officer if I am ISO certified?
Law 21.719 does not link the data protection officer to any ISO certification. Appointing one is voluntary (article 50 says the controller «may» appoint one), unless the company adopts a prevention model, whose programme must include one (article 49 letter a).
When will it be possible to certify the prevention model with the Agency?
Not before December 1, 2026, when Law 21.719 enters into force; neither the law nor Decree 662 sets a date for the procedure to open, and it will also be governed by the rules the Agency issues through a general instruction (article 15 of the regulation). Article 18 of the regulation allows the model to be implemented before the Agency adds the entity to the register.
Official sources
- Law 19.628 consolidated with the amendments of Law 21.719 (in force from December 1, 2026)
- Law 21.719 — text as published, with its transitory provisions, Library of the National Congress
- Decree 662 of 2025, Ministry of Finance — regulation on infringement prevention models
- ISO/IEC 27701:2025 — Privacy information management systems, official page on iso.org
- ISO/IEC 27701:2019 (withdrawn) — official page on iso.org
- ISO/IEC 27001:2022 — Information security management systems, official page on iso.org
- ISO — Certification: who certifies and how to verify a certificate
This article is for information purposes only and does not constitute legal advice for a specific case.