Medical records and health data are sensitive data: reinforced consent, impact assessments and traceability. We implement Law 21.719 in clinics and providers to be ready for December 2026.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
In healthcare, nearly everything your institution records is sensitive data: diagnoses, treatments, test results, medical history. Law 21.719 holds this data to a higher standard, and a clinic manages it at scale, every day, through many hands. That is why compliance here is more demanding than in almost any other sector.
The record concentrates diagnoses, test results, prescriptions and history: it is health data and therefore sensitive. Its value to third parties and the reputational impact of a leak make it the asset that demands the most care within your institution.
Treating minors adds a layer of reinforced protection to every test, referral and entry in their medical history. Handling their clinical data with the same caution as an adult's leaves exposed, precisely, the most vulnerable population within your institution.
Care involves sharing clinical information with insurers, providers, laboratories and the physicians a patient is referred to. Every handoff is a point where sensitive data can be exposed. Without clear rules on who accesses what, confidentiality dissolves along the chain of care.
Physicians, nursing, admissions, billing and support staff all touch the patient record. The more people who access it, the greater the risk of misuse or a breach. The challenge is not only protecting outward, but controlling and logging who opens each record inside the clinic.
At AlayIAtrust we approach healthcare starting from its reality: a high volume of sensitive data, multiple points of access and a constant flow toward insurers, laboratories and providers. We map where each patient's data lives, who processes it and on what legal basis, with a focus on the medical record and the reinforced protection of children and adolescents.
Building on that diagnosis, we organize ARSOP rights so a patient can exercise them without friction, prepare your breach response and get your institution ready for the full enforcement that begins on December 1, 2026, led by the Personal Data Protection Agency. The goal is for clinical confidentiality to stop depending on goodwill and become a verifiable process.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"A device with records was left accessible; it's health data on hundreds of patients."
What the law saysHealth data is sensitive: you must report the breach to the Agency and to the affected patients. Failing to do so is a serious violation; doing so deliberately, a most serious one: up to 20,000 UTM.
"I asked for a copy of my record and tests weeks ago and still no response."
What the law saysYou have 30 calendar days to respond (article 11). Preventing or obstructing the right of access is a serious violation: a fine of up to 10,000 UTM.
"We use patients' data for reminders and campaigns, as always."
What the law saysSensitive data requires express consent (article 16), apart from the exceptions in the law. Knowingly processing it in breach of the law is a most serious violation: up to 20,000 UTM.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
Because health data is a sensitive category and the law holds it to a higher standard: greater security, traceability and more demanding legal bases for processing. In a clinic this multiplies, since almost all the information you handle (diagnoses, test results, records) falls into that category and moves among admissions, care, laboratory and billing.
Yes: processing minors' data requires reinforced protection and special care in how their clinical information is used and shared. We help your admissions, care and recordkeeping flows account for that requirement by design, not as a later patch once the minor's data is already in circulation.
Every handoff of sensitive clinical data must rest on a legal basis that justifies it and on clear access rules. We review those referral, reimbursement and external testing flows so you know what information leaves, to whom and on what grounds, reducing the points where confidentiality could break down along the chain of care.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
