Law 21.663, the Cybersecurity Framework Law: summary, who it applies to and what it requires

Law 21.663, known as the Cybersecurity Framework Law, sets the cybersecurity rules for the State and for companies that provide essential services. It creates the National Cybersecurity Agency (ANCI), the National CSIRT and its own regime of fines. Unlike the data protection law, it is already in force. If you want the full picture, start with our guide to the personal data protection law in Chile.

This summary answers the most common questions about the law: since when it applies, who it binds, what an operator of vital importance is, how an incident is reported and what fines it provides for. At the end we explain what changes when the incident affects personal data, because that is where Law 21.719 comes in. Official sources reviewed on 3 November 2026.

What is Law 21.663 and since when has it been in force?

Law 21.663 is Chile's Cybersecurity Framework Law, published in the Official Gazette on 8 April 2024. Its article 1 states that its purpose is to establish the institutional framework, the principles and the general rules for coordinating the cybersecurity actions of the State and between the State and private parties, and to set minimum requirements for preventing, containing, resolving and responding to incidents.

The law left it to the President of the Republic to set its entry into force by decree with force of law. DFL No. 1 of 2024, issued on 30 October and published on 24 December 2024, set the start of the ANCI's operations and the general entry into force of the law on 1 January 2025, and deferred to 1 March 2025 articles 5, 8 and 9 and Title VII, which governs infringements and sanctions.

Who does Law 21.663 apply to?

Article 4 applies it to institutions that provide essential services and to those the ANCI designates as operators of vital importance. Essential services are those provided by the State Administration and the National Electricity Coordinator, those provided under a public service concession and those of private institutions that carry out any of these activities:

• Electricity generation, transmission or distribution; fuel transport, storage or distribution; drinking water or sanitation.
• Telecommunications, digital infrastructure, and digital and information technology services managed by third parties.
• Road, air, rail or maritime transport, and the operation of its infrastructure.
• Banking, financial services and means of payment; administration of social security benefits.
• Postal and courier services.
• Institutional healthcare provision, such as hospitals, clinics, primary care centres and medical centres, and the production or research of pharmaceutical products.

The ANCI may designate other services as essential through a reasoned resolution and after public consultation, when their disruption could cause serious harm to the population, to relevant economic sectors or to the functioning of the State. Providers of technology managed by third parties are on the list: a company that provides IT services to a bank or a clinic may fall within scope in its own right.

What is an operator of vital importance (OIV)?

An operator of vital importance is a provider of essential services that the ANCI designates as such by resolution, when it meets the two requirements of article 5: its service depends on networks and information systems, and its disruption would have a significant impact on security and public order, on the continuity of essential services or on the functions of the State. The ANCI may also designate private institutions that do not provide essential services if they meet those same two requirements and have acquired a critical role in supplying or producing strategic goods, or because of their degree of exposure to risk.

Designation follows the procedure in article 6: sectoral reports, a preliminary list, a thirty-calendar-day public consultation for private institutions and a final resolution, to be reviewed at least every three years. According to the ANCI, the first process ended in July 2026 with 1,154 institutions designated in total. Article 5 requires the size of the private institution to be taken into account, particularly that of smaller companies.

How is an incident reported under Law 21.663?

All the institutions in article 4, not only operators of vital importance, must report to the National CSIRT any cyberattacks and incidents that may have significant effects, following this scheme from article 9:

• 3 hours: early alert, from the moment the incident becomes known.
• 72 hours: update with an initial assessment, its severity and impact, and indicators of compromise, if any. If an operator of vital importance has its essential services affected, the deadline is 24 hours.
• 15 calendar days: final report from the early alert, with the description, the probable cause, the mitigation measures and any cross-border repercussions.
• 7 calendar days: maximum period for an operator of vital importance to adopt its action plan and report it to the National CSIRT.

Under article 27, an incident has a significant effect if it can interrupt an essential service, affect people's physical integrity or health, or affect information systems that contain personal data. To measure it, the number of people affected, the duration and the geographical extent are taken into account. The same article requires personal data to be omitted from reports, and clarifies that an IP address is not considered personal data for that purpose. The details are governed by the incident reporting regulation (Decree 295 of 2025).

What fines does Law 21.663 provide for?

Article 40 sets fines payable to the State according to the severity of the infringement, and doubles them for operators of vital importance. Failing to comply with the reporting duty in article 9 is a serious infringement (article 38).

In setting the fine, the factors considered are how much the offender had done to safeguard security, the likelihood of the incident occurring, its exposure to risk, the severity of the effects, repeat offences within three years, and its size and economic capacity. If the same facts, on the same legal grounds, can be sanctioned under this law and another, only the most severe sanction is imposed. Infringements become time-barred after three years.

How does Law 21.663 relate to Law 21.719?

They are two separate laws that can be triggered by the same incident. Law 21.663 protects the continuity of essential services and is reported to the National CSIRT within hours. Law 21.719 protects personal data: from 1 December 2026, its article 14 sexies will require reporting to the Personal Data Protection Agency «without undue delay», with no deadline in hours, when there is a reasonable risk to the rights of data subjects. The 72 hours do not come from the data protection law. That date could move if the postponement now before the Chamber of Deputies is passed.

A clinic or a bank that suffers a data leak may have to file both reports, before different authorities and with different content. Article 9 tasks the ANCI with seeking a single point of contact when more than one authority must be notified. We explain this in detail in Law 21.719 and Law 21.663: two duties for the same incident and in breach notification. For the overall picture of the data protection law, see the summary of Law 21.719 and our guide to the personal data protection law.

What should a company do now?

• Confirm whether it applies to you. Check whether your activity is on the list in article 4 and whether you appear in ANCI exempt resolutions 87 of 2025 and 187 of 2026.
• Prepare the 3-hour report. Define who detects, who decides and who reports, and follow the ANCI's reporting instructions.
• If you are an operator of vital importance, appoint the cybersecurity delegate and document the management system, the continuity plans and the training (article 8).
• Align the plan with the data protection law. A single protocol should handle the report to the National CSIRT and, if personal data is involved, the one under Law 21.719. Security measures and a certification such as ISO 27701 help, but they do not replace either duty.

For large and regulated companies, that single protocol is part of our compliance work for large enterprises.

Frequently asked questions

What is Law 21.663?

It is Chile's Cybersecurity Framework Law, published on 8 April 2024. It creates the National Cybersecurity Agency (ANCI) and the National CSIRT, sets cybersecurity duties for essential services and operators of vital importance, and establishes fines of up to 40,000 UTM.

When does Law 21.663 come into force?

It is already in force. DFL No. 1 of 2024 set its general entry into force on 1 January 2025, and that of articles 5, 8 and 9 and of the infringements and sanctions regime on 1 March 2025.

Who does Law 21.663 apply to?

To institutions that provide essential services under article 4 (the State, energy, water, telecommunications, digital infrastructure, IT services managed by third parties, transport, banking and means of payment, social security, postal services and healthcare, among others) and to those the ANCI designates as operators of vital importance.

What is an operator of vital importance?

It is an institution that the ANCI designates by resolution because its service depends on information systems and its disruption would have a significant impact on security, the continuity of essential services or the functions of the State (article 5). It has additional duties, such as an information security management system and a cybersecurity delegate (article 8).

How many operators of vital importance are there in Chile?

According to the ANCI, the first designation process ended in July 2026 with 1,154 institutions designated in total, in two lists: exempt resolution 87, of December 2025, and exempt resolution 187, of July 2026. The designation is reviewed at least every three years.

What is the deadline for reporting an incident under Law 21.663?

To the National CSIRT, with an early alert within 3 hours, an update within 72 hours (24 hours if an operator of vital importance has its essential services affected) and a final report within 15 calendar days, under article 9.

What are the fines under Law 21.663?

Up to 5,000 UTM for minor infringements, 10,000 for serious ones and 20,000 for very serious ones, amounts that are doubled for operators of vital importance (article 40). Failing to report an incident in accordance with article 9 is a serious infringement.

What is the difference between Law 21.663 and Law 21.719?

Law 21.663 governs the cybersecurity of essential services and is reported to the National CSIRT within hours. Law 21.719 governs personal data and, from 1 December 2026, will require breaches to be reported to the Personal Data Protection Agency without undue delay, with no deadline in hours. The same incident can trigger both.

Official sources

• Law 21.663, Cybersecurity Framework Law — Library of the National Congress
• DFL No. 1 of 2024, Ministry of the Interior and Public Security — start date of the ANCI and entry into force of Law 21.663
• Decree 295 of 2025 — regulation on cybersecurity incident reporting
• Decree 285 of 2025 — regulation on the procedure for designating operators of vital importance
• ANCI exempt resolution 87 of 2025 — list of operators of vital importance, first process
• ANCI exempt resolution 187 of 2026 — list from the second stage
• ANCI — «ANCI completes the first designation process for Operators of Vital Importance» (24 July 2026)
• Law 19.628 consolidated with Law 21.719 (version in force from 1 December 2026) — article 14 sexies

This article is for information purposes only and does not constitute legal advice for a specific case.