In October 2026 Chile's Senate approved postponing Law 21.719 to October 15, 2027; the bill is still in the Chamber of Deputies and, until it is published, the legal date remains December 1, 2026. Abroad, Uber received an €825 million fine, Meta a $25 billion judgment and Japan faced a wave of data leaks.
The essentials in 30 seconds
- Status of the postponement checked on November 5, 2026: approved by the Senate, now in the Chamber of Deputies. It is not law.
- The international stories were checked against more than one source. Where the figures differ, we say so.
This summary first appeared in alayIAtrust's monthly newsletter on LinkedIn. We publish it here with the facts checked against the sources and with one extra question for each story: what changes for a company that processes personal data in Chile. If you want the full picture, start with our guide to the personal data protection law in Chile.
The Senate approved postponing Law 21.719 to October 15, 2027
On October 28, 2026 the Senate approved Bill 18.623-07, both in general and in detail. It moves the entry into force of Law 21.719 from December 1, 2026 to October 15, 2027. The Executive had proposed December 1, 2027; the Senate shortened that period.
The bill also changes the Personal Data Protection Agency. Its Board grows from three to five members, with six-year terms that cannot be renewed and a partial renewal every two years, and the quorum to hold sessions rises from two to three members. The proposal for the first appointments must be sent to the Senate no later than nine months before the entry into force, instead of six. Board members will be paid and work full time from their appointment, and the extra cost of the first year will be funded from the budget of the Ministry of Economy, Development and Tourism and, where that falls short, from the Public Treasury.
The bill is now in the Chamber of Deputies, with an "immediate discussion" urgency. In the Senate, Senator Paulina Vodanovic asked that the extra time come with a verifiable timeline and not be "a blank cheque". Until it is published as law, the binding date remains December 1, 2026. The article-by-article detail is in our tracker of the postponement.
A €825 million fine on Uber for deactivating drivers through automated decisions
The Dutch data protection authority (Autoriteit Persoonsgegevens) fined Uber €825 million, about $966 million, for deactivating driver accounts through fully automated decisions, without prior human review, and for not informing drivers adequately about those decisions. The decision was made public in August 2026.
It is the second-largest fine in the history of the European General Data Protection Regulation (GDPR), behind only the €1.2 billion Meta received in 2023. Uber said it will appeal and maintains it never automated permanent deactivations. The authority, for its part, found that the practices have stopped.
What to watch in Chile. Law 21.719 grants the right not to be subject to decisions based on automated processing, including profiling, that produce legal effects or significantly affect the person (article 8 bis). Even when an automated decision is allowed, the controller must guarantee the right to an explanation, to human intervention, to express one's point of view and to request a review. If your company uses rules or models that approve, reject or block people, that flow needs a person able to review the case. We explain it in artificial intelligence and data protection.
Meta must pay $25 billion to New Mexico
On October 21, 2026, a New Mexico judge ordered Meta to pay the state $25 billion. The order follows a September verdict in which a jury found the company liable for more than 43 million violations of the state's unfair practices law, for misleading statements about how it handled its users' personal data. The case grew out of the Cambridge Analytica scandal.
The state sought more than $35 billion and Meta argued for a cap of about $3.45 billion. The company said it will appeal.
What to watch in Chile. The case was not decided under a data protection law but under a consumer protection law: what was punished was the gap between what the company said and what it did. A privacy policy is a public statement and should describe what actually happens to the data. Under Law 21.719 its minimum content is set by article 14 ter; we have a privacy policy example structured around that list.
The European Union proposes changes to its data regulation: the Digital Omnibus
In November 2025 the European Commission presented a package of changes to several digital rules, known as the Digital Omnibus, which includes amendments to the GDPR. Among the most concrete:
- Breach notification to the authority would move from 72 to 96 hours and would only be mandatory when the breach poses a high risk.
- It would clarify that legitimate interest can be a legal basis for developing and operating artificial intelligence systems with personal data, with safeguards such as data minimisation and a right to object.
- The definition of personal data would depend on who processes the information: data would not be personal for an entity that cannot identify the person with means reasonably available to it.
These are proposals. They are still going through the European Parliament and the Council and may change or not be adopted; in the meantime the GDPR applies as it stands, including the 72-hour deadline.
What to watch in Chile. Law 21.719 does not set a number of hours to report a breach to the Agency: article 14 sexies requires doing so "without undue delay" when there is a reasonable risk to data subjects' rights. What is being discussed in Europe does not change that rule. The full comparison is in Law 21.719 vs. GDPR.
A wave of data leaks in Japan and emergency guidelines
Between September and October 2026, more than twenty Japanese companies reported attacks. Among the most cited cases are Times Car, the car-sharing service, which reported a leak linked to about 6.6 million members (including driver's licence images), and the ransomware attack on IDC Frontier, SoftBank's cloud provider, which reached about 495 client organisations. JR East also reported exposed data; the figures published for its case differ between sources.
On October 9, Masaaki Taira, who leads the ruling party's cybersecurity strategy, spoke of a "state of emergency in cyberspace". That same day, the National Cybersecurity Office issued emergency guidelines for companies holding large volumes of personal data: patch quickly, require multi-factor authentication, audit suppliers, and reduce and encrypt the data they keep. Some outlets reported the phrase as a formal government emergency declaration; it was not.
In addition, on October 1 the measures of Japan's active cyber defence law took effect, allowing the police and the Self-Defense Forces to access and neutralise attacking servers, subject to approval and oversight.
What to watch in Chile. The pattern repeats: one compromised supplier drags down hundreds of clients. Under Law 21.719 the controller remains responsible for the data it hands to a processor, which is why the processor contract and the security measures matter. If your company also provides an essential service, the incident must also be reported to the National CSIRT under Law 21.663.
The month in one table
The essentials of each story and its status on the date of publication.
| Story | Key figure | Status | What to review in Chile |
|---|---|---|---|
| Postponement of Law 21.719 | Entry into force on October 15, 2027 | Approved by the Senate; in the Chamber | Keep working: today the date is Dec 1, 2026 |
| Uber fine (Netherlands) | €825 million | Uber will appeal | Human review of automated decisions (art. 8 bis) |
| Meta ruling (New Mexico) | $25 billion | Meta will appeal | A privacy policy that describes what you do |
| Digital Omnibus (European Union) | Breaches: from 72 to 96 hours | Proposal under discussion | Nothing changes in Chilean law |
| Data leaks in Japan | Times Car: 6.6 million members | Emergency guidelines of Oct 9 | Processor contracts and security |
What to do with the extra time, if the postponement passes?
In a 30-minute assessment we review where your company stands against Law 21.719 and what is worth doing now, with or without a postponement.
Schedule an assessmentFrequently asked questions
Has Law 21.719 been postponed?
Not yet. On October 28, 2026 the Senate approved the bill that moves its entry into force to October 15, 2027, but the Chamber of Deputies still has to vote. Until it is published as law, the legal date remains December 1, 2026.
What does the postponement bill change in the Data Protection Agency?
The Board grows from three to five members, with six-year non-renewable terms and a partial renewal every two years, and the quorum to hold sessions rises to three. The first appointments must be proposed to the Senate no later than nine months before entry into force.
Why was Uber fined €825 million?
The Dutch authority found that Uber deactivated driver accounts through fully automated decisions, without prior human review, and did not inform drivers adequately. It is the second-largest GDPR fine. Uber will appeal.
Does Law 21.719 regulate automated decisions?
Yes. Article 8 bis grants the right not to be subject to decisions based on automated processing, including profiling, that produce legal effects or significantly affect the person, with exceptions. In every case there is a right to an explanation, human intervention and review.
Why was Meta ordered to pay in New Mexico?
A jury found it liable for more than 43 million violations of the state unfair practices law for misleading statements about how it handled data, in a case that grew out of Cambridge Analytica. On October 21, 2026 the judge set the payment at $25 billion. Meta will appeal.
What is the Digital Omnibus?
It is a package of changes to European digital rules presented by the European Commission in November 2025. It includes moving breach notification from 72 to 96 hours, only for high-risk breaches, and clarifying the use of legitimate interest for artificial intelligence. It is still under discussion.
Does the deadline to report breaches change in Chile?
No. Law 21.719 does not set a number of hours: article 14 sexies requires reporting to the Agency without undue delay when there is a reasonable risk to data subjects. The 72-hour deadline belongs to the European GDPR, not to Chilean law.
Did Japan declare a state of emergency over cyberattacks?
Not formally. The phrase was used on October 9, 2026 by a ruling party official. That day the National Cybersecurity Office issued emergency guidelines for companies holding large volumes of personal data.
Official sources
- Senate Official Letter No. 355/SEC/26: text approved for Bill 18.623-07 (Spanish)
- Pauta: the Senate approves postponing the Personal Data Protection Law to October 2027 (Spanish)
- Law 19.628 as amended by Law 21.719 (version from Dec 1, 2026) — National Congress Library (Spanish)
- Pearl Cohen: Dutch Data Protection Authority fines Uber €825 million for fully automated deactivation of drivers
- Courthouse News: New Mexico judge orders Meta to pay $25 billion over data privacy
- European Parliament, Legislative Observatory: Digital Omnibus
- The Next Web: Japan steps up cyber warnings as data leaks hit millions of customers
This article is for information purposes only and does not constitute legal advice for a specific case.