Effective date
December 1, 2026
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
We implement Law 21.719 in Chile, end to end
Diagnosis, legal advice, operations, technology and ongoing support. We don't just explain the law: we leave it implemented in your organization.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
Clients who trust AlayIAtrust
The law,
in 30 seconds.
Who it applies to
Every organization
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM or 4% of revenue
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
With a diagnosis
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
What happens
if you don't comply?
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
A customer asks for access to their data and you don't respond in time.
"Weeks ago I asked what data of mine you hold and what you use it for. No one has answered."
What the law saysYou have 30 calendar days to respond (article 11). Preventing or obstructing the exercise of a right is a serious violation: a fine of up to 10,000 UTM.
You have a security breach and you don't report it.
"We detected the incident, but we thought we could solve it internally without escalating it."
What the law saysFailing to report a breach is a serious violation. If the omission is deliberate it becomes a most serious one: a fine of up to 20,000 UTM.
A former employee complains about the use of their data.
"I don't work there anymore, but I keep getting internal communications at my personal email."
What the law saysYou must be able to show the legal basis for that processing. Processing data without consent or another legal ground is a serious violation.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
"Prove to me that Ms. Juanita Pérez did give her consent."
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
❌
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
✓
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
Privacy Operations
Customer
Juanita Pérez González
-
Marketing consent Granted · Web · Apr 12, 2024
- Channel
- Web form (checkout)
- Legal basis
- Express consent
- Text accepted
- Privacy notice v2.3
- Evidence
- Time-stamped record · hash a3f9…e21
-
Privacy notice v2.3 Accepted · Apr 12, 2024
- Version
- 2.3 (current)
- Purposes
- Marketing and profiling
- Record
- IP 190.xx.xx.xx · Apr 12, 2024, 14:22
- Status
- Accepted by the data subject
-
Access request (data subject) Received · Mar 02, 2026 · Resolved in 8 days
- Type
- Right of access
- Legal deadline
- In business days
- Resolution
- 8 days — within deadline
- Owner
- DPO · evidence attached
-
Partial revocation Email marketing · Apr 15, 2026
- Scope
- Email marketing only
- Effect
- Immediate removal from campaigns
- Channel
- Preference center
- Confirmation
- Sent to the data subject the same day
What we leave
implemented.
We organize the data, define the processes and support the people who put them into practice.
Record of processing activities
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
Consent, cookies and ARSOP rights
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
Risks, DPIA and third parties
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
Policies and team
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
The full implementation,
with a single team.
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
First we define the path.
Then we implement it.
Two connected stages, from the diagnosis to going live.
Consulting
- 01
Diagnosis
We assess processing activities, risks and legal, operational, technology and data gaps.
- 02
Gap prioritization
We rank the findings by risk and business impact.
- 03
Compliance plan
We define what to do first, who leads it and which solution fits.
Implementation
- 04
Execution
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
Two paths,
depending on your organization.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
End-to-end SME solution
- What you need to comply, without the complexity of an enterprise solution.
- Consent management, ARSOP rights and a record of processing activities.
- Implementation in 1 to 4 months.
Enterprise
Enterprise solution
- For large data volumes, multiple systems and high regulatory demands.
- OneTrust privacy platform, legal advice and ongoing support.
- Implementation in 3 to 6 months.
Trust is built
on experience.
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →24+
Years of track record of the Alaya group
Since 2002, working with large organizations in Chile.
Team in Chile
Consultants who know the local context, with direct support in Chile.
Banking and retail
Experience in regulated sectors and high-data-volume operations.
Complex projects
Governance, security and digital transformation for large organizations.
People who know
your challenge.
A team that connects legal expertise, technology and management.
-
Luis Sepúlveda
General Manager · CEO
-
Joanna Davidovich
Director
-
Emilio Oñate
Board Advisor
-
Guillermo Aspée
Projects Manager
- Mauricio Domínguez Technical Manager
-
Manuel Labbé
Privacy Consultant
-
Mateo Hirmas
Commercial Manager
-
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
What we get
asked most.
Which companies does Law 21.719 apply to?
To any natural or legal person, public or private, that processes personal data in Chile. It also applies to foreign organizations that offer goods or services to people located in Chile.
Has the entry into force of Law 21.719 been postponed?
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
How much does the initial diagnosis cost?
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
How long does a full implementation take?
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
What fines does Law 21.719 provide for?
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
Do you work with SMEs and enterprise?
Yes. We have a guided solution for SMEs and mid-market, and an end-to-end implementation with OneTrust for enterprise companies in banking, retail, mining and the public sector.
What if I already work with lawyers or a law firm?
We join as a complement. We start from what you have already done with your lawyers on contracts and legal advice, and we integrate the identified gaps and the impact assessments (DPIA) so that compliance works in your operation.
What can the Agency audit?
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Law 21.719,
by industry.
Each industry processes different data and faces its own risks. See the approach for yours.
Is your company ready
for December 2026?
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.