Large volumes of sensitive data, multiple systems and the highest regulatory demands. We take you to compliance with Law 21.719 —legal, operations and technology— to be ready for the December 2026 enforcement.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
In banking and financial services, data is not just another record: it is the raw material behind every credit, risk, and fraud-prevention decision. That concentrates personal information, cross-references it across systems, and transfers it to third parties. Law 21.719 looks precisely at that flow.
You process national IDs, income, debts, contracted products, and transactions: information that lets you reconstruct a person's entire financial life. This concentration raises the standard of lawfulness, security, and minimization the law requires, and turns every credit or risk purpose into something you must be able to justify.
Credit profiling decides who gains access to a product and on what terms. Individuals can exercise their ARSOP rights over that processing: accessing which data feeds it, objecting to it, and requesting rectification. If you cannot explain or trace the logic of the scoring, the regulatory and reputational risk is real.
Reporting to credit-rating agencies, sharing with banking affiliates, or outsourcing collections are all data transfers. Each flow needs a lawful basis and a processing arrangement formalized by contract. Operating out of inertia, because it was always reported this way, shifts the risk across the entire chain of financial providers.
Core banking, loan origination, digital channels, antifraud, and CRM: the same data lives in many systems. That dispersion multiplies the exposure surface and makes it harder to respond to a breach. The law sets a duty to notify breaches, and in banking, reaction time is measured in lost trust.
At AlayIAtrust, we start by mapping financial data end to end: where it originates, which systems touch it, which purposes justify it, and to which bureaus, affiliates, or processors it is transferred. With that inventory we build the data processing record, set the lawful basis for each processing activity, and formalize the contracts across the chain, so that credit scoring and collections stop being black boxes when faced with an ARSOP right or an audit by the Personal Data Protection Agency.
On that foundation we organize the highest-risk flows with data protection impact assessments where appropriate, define the DPO's role, and prepare breach response and notification. The goal is not only to be ready by December 1, 2026, when full enforcement begins, but to sustain operable compliance in a banking sector that moves financial data every single day.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"I want to know what data you hold about me, how you calculate my score and who you share it with."
What the law saysYou have 30 calendar days to respond (article 11). If you cannot trace the data across systems, you will not make it: obstructing the right of access is a serious violation, with a fine of up to 10,000 UTM.
"We detected unauthorized access to the customer base, but we wanted to contain it quietly."
What the law saysWith financial data you must report the breach to the Agency and also to the data subjects. Failing to do so is a serious violation; if the omission is deliberate, a most serious one: up to 20,000 UTM.
"We send data to scoring agencies and affiliates as we always have."
What the law saysEvery disclosure needs a legal basis and a contract. Disclosing data without the data subject's consent, when that consent is required, is a serious violation.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
Reporting to a rating agency is still possible, but you must now be able to support the lawful basis for that transfer and have it formalized with the third party. Historical continuity does not equal compliance: the law requires you to demonstrate why you process and share each piece of financial data, not just that you have always done so.
ARSOP rights extend to credit profiling. Individuals can access the data used, request its rectification, and object to certain processing. You do not need to reveal your model, but you do need traceability: which data feeds the scoring, for what purpose, and under what lawful basis, so you can respond on solid grounds.
With the inventory. Before any policy, we map where each piece of financial data lives, which systems and providers touch it, and where it is transferred. That data processing record is the basis for establishing lawfulness, prioritizing the highest-risk flows, and responding in an orderly way to an ARSOP rights request or a breach.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
