In Chile, a privacy policy compliant with Law 21.719 must permanently publish the twelve items of article 14 ter: who the data controller is, how to contact it, what data it processes, for what purpose and on what basis, who it shares the data with, how long it keeps it, what rights the data subject has and how the information is protected.
The essentials in 30 seconds
- Article 14 ter lists twelve minimum items, from letter a) to letter l), which must be «permanently available to the public».
- It takes effect on 1 December 2026, unless the postponement now before the Chamber of Deputies (Bill 18.623-07) is passed. Law 19.628, in force today, has no equivalent publication duty.
- Failing to publish it, or publishing it incomplete, is a minor infringement (article 34 bis letter a): a written warning or a fine of up to 5,000 UTM.
- The example works as a structure, not as final text: each field must describe your company's actual processing activities.
- The Word template in this article includes the twelve sections with instructions for completing them.
A privacy policy is the public document in which an organization explains what personal data it processes, for what purpose, on what legal basis and how individuals can exercise their rights. With Law 21.719 it stops being a good practice and becomes a legal duty: article 14 ter sets out its minimum content. For the overall picture, start with the summary of Law 21.719. If you want the full picture, start with our guide to the personal data protection law in Chile.
This article provides a complete example, structured around those twelve letters, and a template to download. If what you need is the criteria for drafting one from scratch, see how to draft a privacy policy. Sources reviewed on 3 November 2026.
What is a privacy policy and who must have one in Chile?
A privacy policy is the information the data controller makes available to the public to explain how it processes personal data. Under Law 21.719 it corresponds to letter a) of article 14 ter, which requires publishing «the personal data processing policy it has adopted, its date and version», together with eleven other items.
The duty covers every data controller, that is, whoever decides on the processing: companies of any size, foundations and public bodies. The information must be on the website «or in any other equivalent means of information», on a permanent basis. If your company is not domiciled in Chile but processes data of people residing in the country, article 14 also requires it to keep an email address or other contact channel operational.
The rule applies from 1 December 2026, the date currently set by the first transitory article. The Senate approved a bill to postpone it that would move it to 15 October 2027, but as of 3 November 2026 it is in the Chamber of Deputies and is not law. Law 19.628, in force today, contains no equivalent publication duty.
What must a privacy policy include under article 14 ter?
Article 14 ter lists twelve minimum items. The table summarizes them and shows how they translate into the policy.
| Letter | What the law requires | How it appears in the policy |
|---|---|---|
| a) | The processing policy adopted, with its date and version | Heading with version number and effective date |
| b) | Identification of the data controller and its legal representative, and of the prevention officer if there is one | Company name, RUT (tax ID), address and name of the legal representative |
| c) | Postal address, email, form or equivalent means for receiving requests | Contact section for exercising rights |
| d) | Categories of data, population of individuals, recipients, purposes, legal basis and legitimate interests relied on | Table of purposes with their legal basis and recipients |
| e) | Security policy and measures | General description of the technical and organizational measures |
| f) | Right to request access, rectification, erasure, objection and portability | Section on ARSOP rights (access, rectification, erasure, objection and portability) |
| g) | Right to appeal to the Agency if the data controller rejects a request or does not respond in time | Express mention of the Personal Data Protection Agency |
| h) | Transfers to third countries or international organisations and whether they offer an adequate level of protection; if not, the safeguards | International transfers section |
| i) | Data retention period | Retention period or criterion by type of data |
| j) | Source of the data and whether it comes from publicly accessible sources | Data source section |
| k) | If the basis is consent, the right to withdraw it at any time | Instructions for withdrawing consent |
| l) | Automated decisions and profiling, with meaningful information about the logic involved and its consequences | Automated decisions section, or a statement that they are not used |
Letter d) is the one that requires the most work, because it requires declaring, for each processing activity, its purpose and its legal basis. The bases other than consent are in article 13: data on economic obligations, legal obligation, contract, legitimate interest and defense of a right. We explain them in legal bases and consent.
Privacy policy example to adapt
The following template follows the order of article 14 ter. The text in capital letters between brackets marks fields you must complete. The purposes and bases are examples: replace them with your company's actual processing activities.
1. Who we are (letters a and b)
Personal data processing policy of [COMPANY NAME], RUT (tax ID) [NUMBER], domiciled at [ADDRESS]. Version [N], effective from [DATE]. We are the data controller for the personal data described in this policy. Our legal representative is [NAME]. If we have a prevention officer, we identify them here: [NAME OR POSITION OF THE PREVENTION OFFICER OR DATA PROTECTION OFFICER].
2. How to contact us (letter c)
For any question or to exercise your rights, write to us at [EMAIL] or use the form available at [URL]. Our postal address is [ADDRESS].
3. What data we process and whose (letter d)
We process data of [CUSTOMERS, PROSPECTS, SUPPLIERS, JOB APPLICANTS, WEBSITE VISITORS]. The categories of data are: [IDENTIFICATION, CONTACT, COMMERCIAL DATA, BROWSING DATA]. [STATE WHETHER YOU PROCESS SENSITIVE DATA AND ON WHAT BASIS; IF YOU DO NOT, SAY SO EXPRESSLY].
4. What we use your data for and on what legal basis (letter d)
We use your data to: (i) manage our contractual relationship with you, on the basis of the performance of a contract (article 13 letter c); (ii) comply with tax and accounting obligations, on the basis of a legal obligation (article 13 letter b); (iii) send you commercial information, only if you gave us your consent, which you may withdraw at any time; and (iv) [PURPOSE], on the basis of our legitimate interest, which consists of [DESCRIBE THE INTEREST].
5. Who we share your data with (letter d)
We share data with [TECHNOLOGY PROVIDERS, SUCH AS HOSTING, EMAIL OR CRM], which process it on our behalf as processors and under contract. We also disclose it to authorities when a law requires it. [WE DO NOT SELL PERSONAL DATA: CONFIRM OR DELETE THIS SENTENCE.]
6. International transfers (letter h)
Some of our providers store data in [COUNTRY OR INTERNATIONAL ORGANISATION]. [STATE WHETHER THAT DESTINATION OFFERS AN ADEQUATE LEVEL OF PROTECTION; IF NOT, DESCRIBE THE SAFEGUARDS, FOR EXAMPLE CONTRACTUAL CLAUSES]. If we do not make international transfers, we state it here.
7. How long we keep your data (letter i)
We keep customer data for [PERIOD OR CRITERION], prospect data for [PERIOD] from the last contact, and data required by tax regulations for the period those regulations set. Once the period expires, we erase or anonymize it.
8. Where we obtain your data (letter j)
We obtain the data directly from you, through [FORMS, CONTRACTS, EMAIL]. [IF SOME COMES FROM THIRD PARTIES OR FROM PUBLICLY ACCESSIBLE SOURCES, STATE WHICH ONES].
9. How we protect your data (letter e)
We apply technical and organizational measures proportionate to the risk, such as [ACCESS CONTROL, ENCRYPTION, BACKUPS, STAFF TRAINING]. Our security policy is available at [LOCATION].
10. Your rights (letters f, g and k)
You may request access to, rectification, erasure, objection to and portability of your data by writing to [EMAIL]. We will respond within the legal deadline. If we reject your request or do not respond in time, you may appeal to the Personal Data Protection Agency. When the processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the prior processing.
11. Automated decisions (letter l)
[WE DO NOT MAKE AUTOMATED DECISIONS OR CREATE PROFILES WITH YOUR DATA.] Or: [DESCRIBE THE DECISION OR PROFILE, THE LOGIC INVOLVED AND ITS EXPECTED CONSEQUENCES FOR YOU]. You have the right to object to, and not be subject to, decisions based on the automated processing of your data that produce legal effects on you or significantly affect you, except in the cases provided by law.
12. Changes to this policy (letter a)
We will publish each new version on this page, with its number and effective date. Current version: [N], dated [DATE].
Privacy policy template for Law 21.719 (Word)
The twelve sections of article 14 ter with the fields to complete and a short instruction in each. Use it as a draft: each field must describe your company's actual processing activities.
Download template (.docx) Version 1.0, November 2026. Free to use within your organization. It does not constitute legal advice.How do you adapt the example to your company?
The policy summarizes what your company already does with data, so it cannot be written before you know that. The practical order is this:
- Do the inventory first. List each processing activity with its purpose, its data, its recipients and its retention period. The RAT template in Excel includes those columns.
- Assign a basis to each purpose. Consent is not the only basis: a contract or a legal obligation is usually more stable, because it cannot be withdrawn.
- Declare the legitimate interest when you rely on it. Letter d) of article 14 ter requires stating what it is; mentioning that it exists is not enough.
- Review your providers. Each one that processes data on your behalf must appear as a recipient and have a processing contract. We explain this in contracts with processors (DPA).
- Set up the request channel before publishing. The email or form under letter c) must work from day one, because that is where ARSOP rights requests will arrive.
- Include the date and version. It is an express requirement of letter a), and it lets you prove which text was in force at any given time.
What mistakes are worth avoiding?
- Copying another company's policy. Another organization's purposes, recipients and retention periods do not describe your processing activities, and letter d) requires describing yours.
- Using foreign terminology. Talking about «ARCO rights» or citing the European GDPR as if it were the Chilean law confuses the reader; Chilean law refers to access, rectification, erasure, objection and portability.
- Asking for consent for everything. If the real basis is a contract, presenting it as consent creates a right to withdraw that you will not be able to honor. Article 12 also presumes that consent was not freely given when it is requested under a contract for which that collection is not necessary.
- Leaving out retention periods. Letter i) asks for the period; «as long as necessary» without a criterion does not provide that information.
- Forgetting the Agency. Letter g) requires informing the data subject that they can appeal to it.
- Mixing it up with the cookie policy. The cookie banner collects preferences; the policy informs. If cookies process personal data, they must appear in the policy like any other processing activity. More detail in cookies and consent.
What happens if the privacy policy does not comply?
Failing to comply, in whole or in part, with the information and transparency duty of article 14 ter is a minor infringement (article 34 bis letter a). So is lacking an up-to-date and operational postal address, email or equivalent means for data subjects to exercise their rights (article 34 bis letter b). For companies and other private controllers, minor infringements are punished with a written warning or a fine of up to 5,000 UTM (article 35 letter a). Public bodies have their own regime (article 44).
The policy is also the first thing people see from the outside. Publishing it incomplete signals that the rest of the compliance program may be incomplete too. The full regime is in fines and sanctions under Law 21.719, and the general framework in our guide to Chile's personal data protection law.
If you would rather we draft it based on your actual processing activities, that is our privacy policy compliant with Law 21.719 service.
Does your privacy policy meet the twelve points of article 14 ter?
In a 30-minute assessment we review your current policy against the law and tell you what is missing and which processing activities need to be documented first.
Schedule an assessmentFrequently asked questions
Is a privacy policy mandatory in Chile?
Yes, from 1 December 2026. Article 14 ter of Law 21.719 requires every data controller to keep permanently available to the public, on its website or in an equivalent means, the processing policy it has adopted and eleven other items. Law 19.628, in force today, has no equivalent publication duty.
What must a privacy policy contain under Law 21.719?
The twelve items of article 14 ter: the policy with its date and version, the identity of the data controller, the contact channel, the data, purposes, bases and recipients, the security measures, ARSOP rights (access, rectification, erasure, objection and portability), the right to appeal to the Agency, international transfers, the retention period, the source of the data, the right to withdraw consent and automated decisions.
Can I copy another company's privacy policy?
It is not advisable. Letter d) of article 14 ter requires declaring the categories of data, purposes, bases and recipients of your own processing activities. A copied policy describes another organization's and leaves the information incomplete or incorrect, which is precisely what article 34 bis letter a) punishes.
What fine does a company without a privacy policy face?
Failing to comply, in whole or in part, with the duty of article 14 ter is a minor infringement (article 34 bis letter a). For a company, minor infringements are punished with a written warning or a fine of up to 5,000 UTM, under article 35 letter a).
Does the privacy policy replace consent?
No. The policy informs; consent is one of the bases that authorize processing. When the basis is consent, it must be free, informed, specific as to its purpose, prior and unambiguous, under article 12, and the policy must inform the data subject of the right to withdraw it (article 14 ter letter k).
Where must the privacy policy be published?
On the data controller's website or in any other equivalent means of information, and on a permanent basis, under article 14 ter. It is advisable to link to it from the footer and from every form that collects data.
How often must the privacy policy be updated?
The law does not set a frequency. It requires the policy to state its date and version (article 14 ter letter a), so it should be updated whenever a processing activity, recipient, retention period or transfer changes, keeping a record of each version.
Does a foreign company selling in Chile need a privacy policy?
Yes, if it offers goods or services to people in Chile or monitors their behavior, which are the cases in which article 1 bis extends the law to data controllers established abroad. In addition, article 14 requires a data controller not domiciled in Chile to keep an email address or other contact channel up to date and operational for data subjects and the Agency.
Official sources
- Law 19.628 consolidated with the amendments of Law 21.719 (version in force from 1 December 2026) — articles 12, 13, 14, 14 ter, 34 bis and 35
- Law 21.719 — published text and transitory provisions, Library of the National Congress of Chile
- Law 19.628 on the protection of private life — text in force until 30 November 2026
This article is for information purposes only and does not constitute legal advice for a specific case.