Government bodies process citizens' data at scale and with the highest responsibility. We implement Law 21.719 —legal, operations and technology— to be ready for the December 2026 enforcement.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
No other sector concentrates as much personal data as the public one. A public body does not choose its data subjects: it serves every citizen, almost always without the option of "not providing" the information. That mandatory relationship, combined with the duty of transparency, makes compliance with Law 21.719 especially demanding here.
Electoral rolls, civil registries, social benefits, health, education, and taxation gather the data of millions of people who cannot opt out of providing it. The volume and full coverage turn any incident into a large-scale event, with data subjects who entrust their information out of obligation, not by choice.
Health, socioeconomic status, the condition of children and adolescents, criminal records, or membership in vulnerable groups circulate routinely across public programs and subsidies. Under Law 21.719 these categories demand the utmost care, and improper handling directly affects those least able to defend themselves.
Procedures cross institutions: a single piece of data travels between ministries, municipalities, and services. Each transfer widens the exposure surface and dilutes accountability over who processes what. Defining roles, recording flows, and tracing data end to end is where compliance becomes hardest to sustain.
The sector lives with two duties that can pull against each other: to publish and account for its actions, and at the same time to safeguard personal data. Reconciling access to public information with each data subject's ARSOP rights requires clear criteria to decide what is disclosed, what is anonymized, and what is withheld.
At AlayIAtrust we start from the real map of your flows: what data enters through each procedure, which bodies it travels to, and where it becomes sensitive or exposed. On that basis we organize the record of processing activities, assess the highest-impact processes, and leave your team able to respond to citizen requests and report breaches without improvising.
We don't hand you a report that sits in a drawer. We support institutions so that compliance coexists with the duty of service and transparency, getting ahead of the start of full enforcement on December 1, 2026 with a sustainable roadmap, not a last-minute scramble.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"I asked to access and rectify my data at the agency and got no response within the deadline."
What the law saysPublic bodies must also handle data subjects' rights within the deadline. Failing to do so exposes the body to a complaint before the Agency.
"A system with beneficiaries' data was exposed by a misconfiguration."
What the law saysIt is a security breach: you must report it to the Agency without undue delay and, depending on the type of data, to those affected as well. The reputational cost for the institution is high.
"We process data on thousands of people, but no one is formally responsible for its protection."
What the law saysWithout a clear owner or a record of processing you cannot demonstrate compliance to the Agency. Appointing a data protection officer is voluntary, but someone must be accountable.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
They are compatible duties if clear criteria are defined. Transparency requires publishing and accounting for actions; Law 21.719 protects each data subject's data. The work lies in deciding, case by case, what is disclosed, what is anonymized, and what is withheld, setting written rules the team can apply consistently to every publication or information request.
Interoperability does not dilute responsibilities: each body is accountable for the processing it carries out. The key is to record the flows between institutions, make clear what role each party plays, and what happens to the data at each transfer. That map makes it possible to respond precisely to the Personal Data Protection Agency and to citizens.
With visibility before tools. First we identify what personal and sensitive data each area processes and how it moves across procedures, registries, and platforms, prioritizing the services with the highest volume and citizen exposure. From there, the record of processing is organized, the most critical processes are assessed, and a phased roadmap is built, instead of intervening everywhere at once.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
