Large volumes of customer data, marketing and profiling at scale, cookies and loyalty programs. We take you to compliance with Law 21.719 to be ready for the December 2026 enforcement.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
Retail and e-commerce thrive on knowing the customer: every purchase, every click and every visit leaves a trail. That same wealth of data, which fuels sales, is exactly what Law 21.719 requires you to handle with clear legal bases and real control. Here, compliance is not a formality: it is part of daily operations.
Stores accumulate identification, contact, shipping address and order history data from thousands of people. The greater the volume, the greater the exposure: an extensive database concentrates more risk in the event of unauthorized access and requires controlling who has access, for what purpose and how long each purchase record is retained.
The site collects browsing data through cookies and tracking pixels, often before the visitor decides anything. Without a clear legal basis for processing and valid consent for uses such as advertising and analytics, that silent capture becomes one of the most frequent points of noncompliance in an online store.
Points programs and personalization build detailed profiles of purchasing habits, preferences and purchasing power. Cross-referencing that data to predict behavior or segment offers is legitimate only with defined legal bases and transparency toward the customer about how their purchase information is used.
Physical store, app, marketplace, social media and email campaigns move the same data across platforms and external payment, shipping and marketing providers. Each transfer widens the exposure surface and requires knowing, at all times, where the customer's data is and who is accountable for it.
At AlayIAtrust we start from a simple premise: in retail, data moves quickly and through many hands, so compliance has to live within operations, not on the sidelines. We map how data enters and moves between channels, organize the legal bases behind each commercial use, and put web consent and loyalty programs on solid ground.
We also prepare your team to respond swiftly to customers' ARSOP rights, regardless of the channel they write through (store, app, marketplace or social media), and to react to a data breach without improvising. The goal is for you to keep using data to sell better, with the confidence that this use can withstand scrutiny from the Personal Data Protection Agency.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"We blast the whole list; the checkboxes were pre-ticked by default."
What the law saysConsent must be free, informed and unambiguous: a pre-ticked box does not meet that standard. Processing data without consent or another legal basis is a serious violation.
"There was unauthorized access to the orders system, with data on thousands of customers."
What the law saysYou must report the breach to the Agency without undue delay and, if it includes your customers' commercial or financial data, to them as well. Failing to do so is a serious violation; deliberately, a most serious one.
"We get requests to delete data or see what we hold, and we handle them by hand."
What the law saysEach request has a 30-calendar-day deadline (article 11). Without a process the deadlines lapse: obstructing ARSOP rights is a serious violation.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
The first step is to know which cookies and trackers you actually load, for what purpose, and which third parties are involved. From there, you define the legal basis for each use and adjust the site's consent mechanism so the customer can make an informed decision before advertising or profiling tracking is activated.
Profiling purchasing habits is not prohibited, but it must rest on a valid legal basis and on transparency toward the customer about how their data is used. We help document these uses, review the cross-referencing of information between channels, and make clear to the data subject that they can exercise their ARSOP rights over the profile being built.
Each channel and each external provider, whether for payment, shipping or marketing, adds points where data is copied and shared. The challenge is to have visibility of that flow and to know who is accountable at each stage. We work on that complete map so the same customer receives consistent treatment and you can respond to their requests no matter where they purchased.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
