Postponing Law 21.719: what the bill says and what is still in force

Since 1 September 2026 there has been a bill before the Chilean Senate proposing to move the entry into force of Law 21.719 to 1 December 2027. The news travelled fast, and with it a hasty conclusion: that Chile's data protection law “has been postponed” and that there is an extra year of slack. If you want the full picture, start with our guide to the data protection law in Chile.

That is not the case, at least not yet. A bill in its first stage changes nothing. The date that binds today is the one set by the first transitory article of Law 21.719: 1 December 2026.

What follows explains exactly what Bill 18.623-07 says, what stage it has reached, why the Executive filed it, and what it changes in practice for an organisation that processes personal data. The short version: the exam date moved, not the syllabus.

What is Bill 18.623-07 and what stage is it at today?

Boletín 18.623-07 is a bill initiated by a presidential message. Its title reads “Amends law No. 21.719, which regulates the protection and processing of personal data and creates the Personal Data Protection Agency, in the sense indicated”; it was signed in Santiago on 31 August 2026 and entered the Senate on 1 September 2026.

As of 11 September 2026 it is in process, in its first constitutional stage, with the Senate as chamber of origin. No later stage is on record: no floor vote, no passage to the Chamber of Deputies, no enactment.

The distinction matters more than it appears. A presidential message is a proposal, not a rule. A bill can be amended during debate, it can be approved with a deadline different from the one requested, and it may never become law. Until it is published in the Diario Oficial it produces no legal effect.

• Type: bill initiated by presidential message (Message No. 110-374).
• Signed: 31 August 2026. Filed: 1 September 2026.
• Chamber of origin: Senate. First constitutional stage.
• Status as of 11 September 2026: in process, with no later stage on record.

Has the entry into force of Law 21.719 been postponed?

No. The date in force is still 1 December 2026, set by the first transitory article of Law 21.719. The bill proposes replacing the formula “the first day of the twenty-fourth month following the publication of this law in the Diario Oficial” with “1 December 2027”, that is, twelve months more. It proposes it; it has not done it.

For the date to change, the whole sequence has to be completed: debate and approval in the Senate, approval in the Chamber of Deputies, resolution of any disagreements, enactment and publication in the Diario Oficial. Any text claiming today that “the law enters into force in December 2027” is saying something the law does not say.

This is not a formality. An organisation that plans around 1 December 2027 and gets it wrong reaches 1 December 2026 with enforceable obligations and nothing implemented. One that plans around 2026 and then sees the postponement approved gains twelve months of margin. The risk is asymmetric, and that asymmetry is the whole decision.

• Date binding today: 1 December 2026.
• Date the bill proposes: 1 December 2027.
• The change only takes effect upon publication in the Diario Oficial.

What does the bill's single article change?

The bill has a single article with four items, plus two transitory provisions of its own. Item 1 amends article 30 quáter: it raises the Agency's Board from three to five members, keeps the six-year term with no reappointment, adds that the Board will be partially renewed every two years, and raises the quorum from two to three members.

Item 2 is the postponement itself. Item 3 rewrites the fourth transitory article: the first appointment will be made “no later than twelve months before” entry into force; in the proposal sent to the Senate the President will identify, in a single act, two people serving two years, two serving four and one serving six; the Senate must rule on the proposal as a single unit and approval will require the favourable vote of two thirds of sitting senators; if the Senate does not rule before the deadline, the proposal is deemed accepted without further formality. A new paragraph adds that board members are paid from the date they are deemed appointed and are subject to exclusive dedication.

Item 4 is the one with the greatest practical effect for an organisation, and the one that has drawn least attention next to the date and the one with the greatest practical effect. Today the sixth transitory article limits to smaller companies the Agency's power to issue a written warning during the first twelve months in force. The bill removes that limitation, so the power would be available with respect to every entity bound by the law. Its discretionary character and its entry in the National Register of Sanctions and Compliance are preserved: it is a warning that goes on the record, not a clean slate.

The bill's own transitory provisions add two rules. The first governs the funding of the additional fiscal spending. The second sets a calendar rule worth reading closely: if, at the date that law is published, fewer than twelve months remain before the entry into force of Law 21.719, the first appointment of board members must be made within ten days following that publication.

• Item 1: five board members instead of three, a quorum of three, and partial renewal every two years.
• Item 2: entry into force would move to 1 December 2027.
• Item 3: first appointment no later than twelve months before, with the proposal voted as a single unit by two thirds of sitting senators.
• Item 4: the first year of written warnings would stop being exclusive to smaller companies.
• Transitory provision: ten days for the first appointment if, upon publication, fewer than twelve months remain before entry into force.

Why is the Executive asking for the postponement?

The message gives an institutional reason: implementing Law 21.719 is a process of particular complexity and requires the entry into force of the regime to match the effective installation of the institutions that must apply it. Specifically, the Agency's Board must be constituted far enough in advance to issue the regulatory definitions.

The immediate background is a rejection. On 19 May 2026 the proposed board members failed to reach the required threshold in the Senate: 19 votes in favour and 12 against, where two thirds of sitting senators were required. The Agency still has no Board.

On composition, the message reasons from the statute itself: article 30 quáter sets a minimum quorum of two members and decisions by majority, so the absence or abstention of one reduces those able to decide to two, and a second impediment prevents the Board from acting at all. It invokes the precedent of Law 21.000: for the Financial Market Commission the Executive also proposed three members, the Senate's Finance Committee flagged the same problem, and the outcome was five. It also cites the Board of the Central Bank of Chile, the Autonomous Fiscal Council and the Senior Public Management Council as five-member bodies.

There is a limitation that explains the urgency. Under the fourth transitory article, from appointment and before entry into force the Board may only exercise the functions in letters a), b), g) and h) of article 30 bis and those in article 30 ter, and any instruction or general rule it issues will only be binding from the law's entry into force. Without a Board installed in time, that window for regulatory preparation simply goes unused.

The length of the extension, by contrast, is not settled. According to the AGPD, the association of data protection professionals, the postponement should be capped at six months: it argues that a longer period is unnecessary and disproportionate —the law already had a two-year vacancy— and that it penalises those who invested to comply on time. That is an industry position, not a rule, and the bill does not adopt it.

• Senate rejection of 19 May 2026: 19 in favour and 12 against, against a threshold of two thirds of sitting senators.
• Precedent cited in the message: Law 21.000 and the Financial Market Commission, which went from three members to five.
• Members of the Ministerial Advisory Commission created by decree No. 12 of 2025, of the General Secretariat of the Presidency, cannot sit on the first Board.
• According to the AGPD, the postponement should be capped at six months.

What to do now: the answer is not to wait

The exam date moved, not the syllabus. None of the bill's four items touches a single substantive obligation: not the eight principles of article 3, not the lawful bases, not the ARSOP rights —access, rectification, erasure, objection and portability—, not the security duty, not breach reporting, not the information required by article 14 ter, and not the fine brackets: up to 5,000 UTM for minor infringements, up to 10,000 UTM for serious ones and up to 20,000 UTM for very serious ones. Everything that had to be done is still exactly the same.

The regulatory framework, moreover, is moving independently of the legislative debate. Decree 662 of the Ministry of Finance, which approves the regulation on the requirements, arrangements and procedures for implementing, certifying, registering and supervising the infringement prevention models under article 49, was published in the Diario Oficial on 9 September 2026: eight days after the postponement bill was filed. The institutions are running late; the rules did not stop.

Those already working gain nothing by stopping. The processing inventory, the lawful bases, the contracts with processors and the procedures for handling rights requests are the same ones the law will require, with or without a postponement, and arriving with a programme already running is not the same as arriving with one just written. Those who have not started face the same workload; they would only have more calendar, and that calendar is not secured yet.

There is one decision worth taking with the bill on the table. If the organisation plans to adopt and certify an infringement prevention model, the regulation already published requires appointing a data protection officer. Appointment is voluntary as a general rule —article 50 of the law says the controller “may” appoint one— but article 6 of the regulation makes it mandatory within the adoption and certification of a compliance programme. And that certificate, under the same regulation, is issued by the Agency and is valid for three years.

• Keep 1 December 2026 as the planning date until there is publication in the Diario Oficial.
• Build the processing inventory and the lawful bases: it is the foundation for everything else and depends on no postponement.
• Prepare the information required by article 14 ter and the procedures for handling ARSOP rights.
• Review contracts with processors and the regime for international transfers.
• If certifying a prevention model is on the table, read Decree 662 and settle the appointment of the officer.
• Track the bill on the Senate's website before moving any plan.

Frequently asked questions

Has Law 21.719 been postponed?

No. There is a bill, Boletín 18.623-07, proposing to postpone it, but it has been before the Senate since 1 September 2026. Until it is approved and published in the Diario Oficial, entry into force remains 1 December 2026.

What is the entry into force date of Law 21.719 today?

1 December 2026, under the first transitory article of Law 21.719, which sets it as the first day of the twenty-fourth month following publication of the law in the Diario Oficial, which occurred on 13 December 2024.

What is Bill 18.623-07?

It is the bill amending Law 21.719. It was initiated by a message from the President of the Republic, signed on 31 August 2026 and filed with the Senate on 1 September 2026. It contains a single article with four items and two transitory provisions.

Is the new date for Law 21.719 1 December 2027?

That is the date the bill proposes, not the date in force. Item 2 of the single article would replace the current formula with “1 December 2027”, twelve months more. It becomes the applicable date only if the bill becomes law and is published.

What stage has the postponement bill reached?

As of 11 September 2026 it is in process, in its first constitutional stage, with the Senate as chamber of origin and no later stage on record. The status can be verified on the Senate's tracking website.

Why is a postponement of Law 21.719 being requested?

According to the message, because the entry into force of the regime must match the effective installation of the institutions. The Agency still has no Board: on 19 May 2026 the Senate rejected the proposed members with 19 votes in favour and 12 against, where two thirds of sitting senators were required.

Does the postponement change companies' obligations?

No. The bill only touches the composition and quorum of the Board, the entry into force date, the deadline and form of the first appointment of board members, and the scope of the first year's written warning. The principles, lawful bases, data subject rights, security duty and sanctions regime stay the same.

What would happen to the first year's written warning?

Today the sixth transitory article limits that Agency power to companies qualified as smaller enterprises during the first twelve months in force. The bill removes the limitation and would make it applicable to every entity bound by the law. It remains discretionary and is entered in the National Register of Sanctions and Compliance.

Is it worth waiting for the postponement before starting to comply?

No. The required work does not change and rests on a processing inventory no one can build for the organisation. If the postponement is not approved, the date is still 1 December 2026; if it is approved, whoever moved early arrives with the programme running rather than just written.

Have the regulations under Law 21.719 also been postponed?

No. The regulatory framework is advancing separately: Decree 662 of the Ministry of Finance, governing the implementation, certification, registration and supervision of the infringement prevention models under article 49, was published in the Diario Oficial on 9 September 2026.

Official sources

• Law 21.719 — official text, Library of the National Congress of Chile
• Law 19.628 consolidated with the amendments of Law 21.719 (version in force from 1 December 2026)
• Decree 662, Ministry of Finance — regulation on infringement prevention models
• Bill tracking — Senate of the Republic of Chile
• Senate of Chile — release “Desestiman propuesta de consejeros para la Agencia de Protección de Datos”
• Diario Oficial of the Republic of Chile

This article is for information purposes only and does not constitute legal advice for a specific case.