In Chile, the sanction procedure under Law 21.719 is conducted by the Personal Data Protection Agency. It starts with a statement of charges served on the controller, who has 15 working days to file a defence. The final decision can be challenged before the Court of Appeals.
The essentials in 30 seconds
- The Agency can start it on its own initiative or at the request of a party.
- The opening move is the statement of charges, not an informal notice.
- The deadline to respond is 15 working days, and it is the key defence window.
- The evidence stage, where opened, lasts 10 days.
- The illegality claim is filed within 15 working days before the Court of Appeals.
Article 42 is titled “Administrative procedure for infringement of the law” and governs how the Agency determines infringements and applies sanctions. It is the mechanism connecting the article 3 principles with the fines everyone quotes. If you want the full picture, start with our guide to the data protection law in Chile.
Knowing it has immediate practical value: it defines the moment a company stops being able to fix things informally and enters a file with hard deadlines. That moment is the statement of charges.
This article walks through the procedure in the order it happens and ends with the judicial route in article 43, where the legality of the Agency's decision is reviewed.
How does a sanction procedure begin?
Article 42 establishes that the procedure is conducted by the Agency, and that it may begin “on its own initiative or at the request of a party, as a result of an inspection process or following a complaint filed by a data subject”.
There are therefore three entry routes, and only one depends on the Agency's own will. The other two can be triggered by an inspection or by a single person's complaint under the procedures in articles 23 and 41.
Where the origin is a data subject complaint, the law requires the Agency to certify receipt of that complaint. And together with opening the file, it must appoint an official responsible for conducting the procedure.
- On the Agency's own initiative.
- As a result of an inspection process.
- Following a complaint filed by a data subject.
What is the statement of charges and how is it served?
It is the act that formally opens the adversarial stage. Article 42(c) requires the Agency to file a statement of charges against the controller “describing the facts constituting the infringement, the principles and obligations breached or violated by the controller, the legal provisions infringed and any other background supporting the statement”.
The service detail is where many companies expose themselves without realising. Subparagraph (d) provides that the statement of charges is served on the controller “at its postal address, email address or other equivalent electronic means indicated under article 14 ter(c)”.
In other words: the contact mailbox the company published for purposes of the law is also the address through which sanction proceedings arrive. If that mailbox has no owner, is not checked daily or filters messages, the response deadline starts running anyway.
How long is there to respond?
Fifteen working days. Article 42(e) states that the controller shall have that period to file its defence, and adds that at that point it may submit all the evidence it considers relevant to rebut the alleged facts.
The same subparagraph imposes an additional requirement worth anticipating: together with the defence, the controller must designate an email address through which all further communications and notifications in the procedure will be made.
In practice, those fifteen working days are the real defence window. It is when the documentation demonstrating the lawfulness of processing is produced, and it shows immediately whether the company kept its record of processing activities current.
How are the facts proved in the procedure?
Once the defence is received or the deadline has lapsed, the Agency “may open a ten-day evidence period where substantial, relevant and disputed facts exist”. It is not automatic: it applies where there is a genuine dispute over the facts.
Subparagraph (g) protects the controller's right to produce evidence: the Agency must grant the evidentiary measures the controller requested in its defence, provided they are relevant and necessary, and if it refuses them it must give reasons.
On the weight of evidence, subparagraph (h) admits any means of proof admissible in law and provides that it shall be assessed according to the rules of sound judgement. The Agency, for its part, has broad powers to request background material or reports contributing to its decision.
| Stage | Deadline | Provision |
|---|---|---|
| Controller's defence | 15 working days | Art. 42(e) |
| Evidence period (if opened) | 10 days | Art. 42(f) |
| Illegality claim before the Court | 15 working days from service | Art. 43 |
| Agency's report to the Court | 10 days | Art. 43(c) |
What must the decision closing the procedure contain?
Subparagraph (j) is demanding on the Agency. The decision must be reasoned and resolve every issue raised in the file, “ruling on each of the arguments and defences put forward by the controller”, and must state whether the infringement was established or the controller is acquitted.
If the Agency finds an infringement, in the same decision it must weigh the circumstances aggravating or mitigating the offender's liability and impose the sanction according to the seriousness of the infringement committed.
Subparagraph (k) adds a formal requirement that works as a safeguard for the company: the decision must state the administrative and judicial remedies available against it, the bodies before which they must be filed, and the deadlines for doing so.
How is the Agency's decision challenged in court?
Article 43 governs the judicial claim procedure. It allows an illegality claim by those who consider unlawful an administrative act that halts the procedure, or a final or terminating decision issued by the Agency.
The competent court is chosen by the claimant: the Santiago Court of Appeals or the one for the place where the claimant is domiciled. The deadline to file is fifteen working days following service of the challenged decision.
The pleading must state precisely the decision being challenged, the legal provisions allegedly infringed, how the infringement occurred and, where applicable, why the act causes prejudice. If it does not meet those conditions, the Court may declare it inadmissible.
There is one tool worth remembering: the Court “may order a stay where enforcement of the challenged act would cause irreparable harm to the claimant”. Once the claim is received, it will request a report from the Agency, granting it a ten-day period.
Could you evidence your compliance in 15 working days?
That is the real defence window. In 30 minutes we assess whether your current documentation would answer a statement of charges.
Schedule an assessmentFrequently asked questions
Who conducts the sanction procedure under Law 21.719?
The Personal Data Protection Agency, under article 42(a). Together with opening the file it must appoint an official responsible for conducting the procedure.
How many days do I have to file a defence?
Fifteen working days from service of the statement of charges, under article 42(e). In that same filing you may submit all relevant evidence, and you must designate an email address for subsequent communications.
Can a single customer complaint open a procedure?
Yes. Article 42(b) allows the procedure to begin following a complaint filed by a data subject, under the procedures in articles 23 and 41. In that case the Agency must certify receipt of the complaint.
Where is the statement of charges served?
At the postal address, email address or other equivalent electronic means the company designated under article 14 ter(c). That contact channel must therefore have an assigned owner and be checked regularly.
Is an evidence stage always opened?
No. Article 42(f) provides that the Agency may open a ten-day evidence period only where substantial, relevant and disputed facts exist. Where the facts are not in dispute, the procedure moves on without that stage.
How is evidence assessed?
Facts and liability may be established by any means of proof admissible in law, and are assessed according to the rules of sound judgement, under article 42(h).
Can I challenge the fine in court?
Yes. Article 43 provides for an illegality claim before the Santiago Court of Appeals or the court for the claimant's domicile, at the claimant's choice, within fifteen working days following service of the challenged decision.
Can the decision be suspended while the claim is pending?
The Court may order a stay where enforcement of the challenged act would cause irreparable harm to the claimant, under article 43(b). It is not automatic: it must be requested and substantiated.
What happens if the claim is badly drafted?
The Court may declare the claim inadmissible if the pleading does not state precisely the challenged decision, the provisions allegedly infringed, how the infringement occurred and, where applicable, the prejudice caused.
Must the decision address my arguments?
Yes. Article 42(j) requires the decision to be reasoned and to rule on each of the arguments and defences put forward by the controller, as well as to weigh aggravating and mitigating circumstances when imposing the sanction.
Official sources
- Law 21.719 — official text, Library of the National Congress
- Law 19.628 consolidated with the amendments of Law 21.719
This article is for information purposes only and does not constitute legal advice for a specific case.