Health data (sensitive), automated underwriting and profiling, reinsurance and claims: the sector with the most sensitive data per policy. We implement Law 21.719 to be ready for the December 2026 enforcement.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
The insurance business runs on people's most intimate data: health, claims histories, and risk profiles. That raw material is precisely what Law 21.719 protects with the highest demands, which makes compliance more challenging here than in almost any other sector.
To price and underwrite policies, insurers process health data, diagnoses, and medical histories. Law 21.719 grants sensitive data stronger protection, so every use must rest on a clear legal basis and on safeguards proportional to its sensitivity.
Handling a claim accumulates medical reports, expert assessments, photographs, and statements. That file concentrates sensitive information that moves between areas and third parties, and demands access controls, minimization, and traceability over who consults each piece of the insured's data and for what purpose.
Brokers, loss adjusters, and reinsurers access policyholder data as part of the chain. Every transfer must be backed by a contract and recorded, because the insurer remains responsible for that data even when it leaves its systems and reaches a third party.
Segmenting and setting premiums through automated profiling means processing policyholder data to decide terms and price. ARSOP rights apply to such processing, so pricing models need transparency, documented criteria, and channels for the insured to access or object to the processing of their data.
At AlayIAtrust, we approach insurance from its most critical point: sensitive data. We map where health and claims data originate and circulate, build the specific RAT for underwriting, claims handling, and reinsurance, and apply a DPIA wherever profiling and pricing justify it because of their impact on people.
We also organize the chain of brokers, loss adjusters, and reinsurers with agreements and records that demonstrate control, prepare the response to policyholders' ARSOP rights, and have breach notification ready. Before December 1, 2026, when full enforcement by the Personal Data Protection Agency begins, your operation is left with demonstrable evidence and processes.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"We use medical history to price and renew policies, as always."
What the law saysHealth data is sensitive and requires express consent (article 16), apart from the exceptions in the law. Knowingly processing it without that basis is a most serious violation: up to 20,000 UTM.
"The system rejects or raises prices, but we can't justify each decision."
What the law saysData subjects can object to automated decisions that significantly affect them (article 8 bis), and that processing requires a prior impact assessment (article 15 ter).
"We send records to reinsurers and providers as part of the process."
What the law saysEvery disclosure needs a legal basis and a contract. With health data, knowingly disclosing it in breach of the law is a most serious violation.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
Because Law 21.719 protects health data with a stronger standard, and underwriting and claims depend precisely on that information. Keeping it safeguarded is not enough: you must have a legal basis for each use, limit who has access, and ensure the processing is proportional. That is why the sector's processes require stricter controls than those of other industries.
The insurer remains responsible for its policyholders' data even when it shares them with brokers, loss adjusters, or reinsurers. Every transfer must be backed by a contract, recorded, and limited to what is necessary. At AlayIAtrust, we organize that chain so each party has a defined role and responsibility is documented.
Yes. Profiling to set premiums processes policyholder data to decide their terms, and ARSOP rights, which include the right to object, apply to such processing. This does not prevent pricing, but it requires documented criteria, transparency toward the insured, and mechanisms for them to access their information or object when appropriate.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
