Diagnosis, documents, consents and processes right-sized for a small or mid-sized company, so you're ready for the December 2026 enforcement. Without the cost or complexity of an enterprise solution.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
SMBs and mid-market companies process as much personal data as a large enterprise, yet they rarely have a dedicated legal or IT team. Law 21.719 makes no distinction by size: the same obligations apply, and the Personal Data Protection Agency will enforce in full starting December 1, 2026.
An SMB accumulates customer data across spreadsheets, emails, sales systems, and WhatsApp, often with no clear owner. That fragmentation makes it harder to handle ARSOP rights when a customer exercises them and increases the risk of processing information without a legal basis or control.
Any company with employees handles data on payroll, health, contracts, and job applicants. In the mid-market, HR often operates without formal processing policies, which exposes sensitive information and complicates responding to an employee request or an enforcement action.
SMBs outsource billing, marketing, cloud, and support to third parties. Every vendor that accesses personal data is a point of risk: without agreements or mapping, a breach in an external tool becomes your own liability before the regulator.
Without a dedicated IT team, a compromised email account or ransomware can go unnoticed for days in an SMB. The law provides for breach notification, and reacting without prior protocols raises the risk of sanction. Infractions are penalized in tiers of up to 5,000, 10,000, and 20,000 UTM depending on their severity.
At AlayIAtrust we design compliance tailored to those without a legal area or a full IT team. We prioritize the essentials first: organizing which customer and employee data is processed, keeping the Record of Processing Activities (RAT) up to date, and preparing breach notification with clear steps for your team.
We support you according to each company's size and budget. Where appropriate, we take on the role of external Data Protection Officer (DPO) and apply Impact Assessments (EIPD) only where the risk justifies it, so you comply with Law 21.719 without slowing down operations or adding unnecessary complexity.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"I left months ago and I keep getting emails and messages on my personal number."
What the law saysYou must be able to show the legal basis for that processing and have an opt-out process. Processing data without consent or another legal ground is a serious violation, for an SME too.
"I sent the customer Excel to the wrong vendor; I thought it was no big deal."
What the law saysIt is a security breach. If there is a risk to the data subjects, you must report it to the Agency without undue delay. Failing to do so is a serious violation.
"I asked what data of mine they hold and what for. No one at the company knew what to do."
What the law saysYou have 30 calendar days to respond (article 11). With no one assigned, the deadline lapses, and obstructing a right is a serious violation.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
Yes. The law sets no thresholds by size or revenue: if you process personal data of customers, employees, or vendors, the obligations apply. The difference lies in resources, not in requirements. That is why we adapt compliance to each SMB's reality, prioritizing what is critical and avoiding structures that are disproportionate to your operation.
Not necessarily. Many SMBs comply without adding in-house staff by relying on external support. AlayIAtrust can take on the role of external Data Protection Officer (DPO) and keep your processes organized, so your current team manages day-to-day work with clear guidance instead of improvising with each request or incident.
It is best to start by understanding what data you process and where it resides, organizing the Record of Processing Activities (RAT), and preparing your response to ARSOP rights and to breaches. That is the foundation that reduces the most risk with the least investment. From there we advance in stages, according to your capacity, before full enforcement begins on December 1, 2026.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
