Worker health exams, biometric access control, contractors and site CCTV: more sensitive data than it seems. We implement Law 21.719 to be ready for the December 2026 enforcement.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
Mining brings together large workforces, dispersed sites, and an extensive chain of suppliers. This multiplies the points where personal data of workers and contractors is generated, copied, and moved. Compliance here is demanding because data rarely stays still: it moves between camps, headquarters, and third parties.
A single person leaves traces in the camp, the plant, headquarters, and rotating shift systems. This geographic and system dispersion makes it hard to know where each piece of data lives, who accesses it, and for what purpose: the first step is to map it in a record of processing activities (RPA).
Managing health and safety at a mining site generates especially sensitive information about the worker, from high-altitude medical exams to exposure to hazards. Processing it requires a solid lawful basis, role-restricted access, and defined retention periods, not shared folders that anyone in the area can open.
Mining contractors, personnel transport, catering, occupational health, and external services form a long chain where data changes hands. Each transfer is a hand-off that must be governed by contract and traceability; the controller remains accountable across the entire chain.
Equipment telemetry, truck geolocation, and per-shift productivity records may seem like mere machine data, but they are often associated with an identifiable operator. When that happens, they become personal data and fall within the scope of the law.
At AlayIAtrust we start from what is specific to a mining operation: where data is generated across the site, how it moves between locations and third parties, and which occupational health and safety information deserves reinforced protection. We build the record of processing activities on that real map, not on a generic office model.
On that basis, we organize the chain of contractors and suppliers with agreements and traceability, and we make ARSOP rights operational for a large workforce with high turnover, so that you can respond on time when a worker or contractor exercises them, and arrive prepared for the full enforcement that begins on December 1, 2026.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"We store pre-employment exams and medical leave, but no one controls who accesses them."
What the law saysMedical exams and sick-leave records are sensitive data. Breaching the duty of confidentiality over sensitive data is a most serious violation: up to 20,000 UTM.
"Site entry is by fingerprint and facial recognition; it's always been that way."
What the law saysBiometric data may only be processed with express consent and by giving the data subject the information required by article 16 ter. Using it without that basis breaches the law.
"Every contractor and subcontractor accesses staff data and there's no data contract."
What the law saysEvery processor needs a contract governing the processing. Without it, you remain liable as controller for what the whole chain does.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
With an inventory that spans all sites and headquarters. Before defining controls, you need to know where each piece of data is generated, where it is copied to, and who consults it across camps, the plant, and headquarters. The record of processing activities consolidates that scattered view in a single place and reveals the hand-offs between sites that are not documented today.
The data controller remains accountable across the chain, even when the operation is outsourced on site. That is why every contractor or supplier that accesses data must be governed by a contract setting out purposes, measures, and security obligations, with traceability of what is shared and for what.
When that information is linked to an identifiable worker, such as the operator of a piece of equipment or the driver of a truck, it stops being mere machine data and becomes personal data. In that case it requires a lawful basis, a declared purpose, and retention periods, just like the rest of the processing in the operation.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
