Millions of subscribers, traffic data, geolocation and retention: one of the country's largest concentrations of personal data. We implement Law 21.719 —legal, operations and technology— to be ready for the December 2026 enforcement.
Request a diagnosis See what we implementIn force: December 1, 2026 · Enforced by the Personal Data Protection Agency · No-commitment diagnosis
A carrier does not just store names and invoices. It knows where every customer has been, who they communicated with, and at what time. That trail makes the sector one of the most exposed in Chile under Law 21.719, and one of the hardest to govern.
Traffic metadata and geolocation reveal routines, relationships, and movements. It is not just "one more data point": when cross-referenced, it draws an intimate profile of the person. Processing that information requires a solid legal basis and, depending on the level of risk, an impact assessment (DPIA) that justifies and limits its use.
With enormous customer bases, ARSOP rights arrive in volume and through multiple channels: app, call center, stores, and number portability. Without defined processes and a record of processing activities (RoPA) kept up to date by purpose, handling those requests stops being an occasional task and becomes a permanent operational risk.
Activation, billing, network, support, and marketing rarely share a single source. The same customer exists across different platforms, sometimes belonging to external providers. That fragmentation makes it hard to know what is processed, where, and for how long: the central challenge of data retention and deletion.
High volume, many integrations, and geolocation data increase both the likelihood and the impact of an incident. When one occurs, breach notification leaves no room for improvisation: you must detect, assess, and communicate with traceability, not reconstruct evidence by hand.
In telecommunications, the problem is rarely the willingness to comply; it is scale. When every purpose multiplies the records and every system keeps its own copy of the customer, compliance only holds if it is designed to operate at volume, not as a one-off effort.
That is why AlayIAtrust starts by understanding how data actually flows through your operation -what is processed, for what purpose, and where- and builds traceability, rights processes, and breach response on top of that. The goal is not a report: it is that, when the Personal Data Protection Agency asks about a specific case, your team can demonstrate it in minutes.
Effective date
This is the legal date in force. From that day the Personal Data Protection Agency can enforce the law.
Who it applies to
Public or private, large or small. If you process personal data of people in Chile, you must comply.
Fines
Up to 20,000 UTM for the most serious violations. If a large company reoffends, the fine can reach 4% of its annual revenue (article 35).
Where to start
First, know where you stand. Then come the plan, the implementation and ongoing support.
Was the law postponed? No. A bill before the Senate proposes moving the effective date to December 1, 2027, but until it is published as law the date remains December 1, 2026. What the postponement bill says · Official text of Law 21.719 (BCN, in Spanish)
This isn't a law that stays on paper. Here are three common scenarios and what the law says about each.
"There was unauthorized access to the customer base and traffic records."
What the law saysYou must report the breach to the Agency without undue delay and, depending on the type of data, to subscribers as well. Failing to do so is a serious violation; deliberately, a most serious one: up to 20,000 UTM.
"We use location and usage data for campaigns and analytics, as always."
What the law saysGeolocation data has its own rules on informing the data subject (article 16 sexies). Using it for campaigns without a legal basis is a serious violation.
"Access and portability requests come in and we have no way to handle them at scale."
What the law saysEach request has a 30-calendar-day deadline (article 11). At that volume, without automation the deadlines lapse: obstructing ARSOP rights is a serious violation.
For a large company that reoffends, the fine can reach 2% of its annual revenue for a serious violation and 4% for a most serious one. Sanctions are entered in the National Registry of Sanctions and Compliance. How the fines work
Imagine that tomorrow the Agency requires you to prove that a specific customer authorized the use of their data. How long does it take your team to pull the evidence together?
Without a system: days digging through spreadsheets and folders. Risk of error and a penalty for failing to demonstrate compliance.
With AlayIAtrust: you search the name and the entire trail appears — consents, data subject requests, notice version, date and channel.
We organize the data, define the processes and support the people who put them into practice.
We identify what data you process, what you use it for and on which legal basis.
Guides: Record of processing · Legal bases
We manage consent, including cookie consent, and the handling of ARSOP rights, the expanded version of the classic ARCO rights.
Guides: Cookies · ARSOP rights
We assess privacy risks with impact assessments (DPIA), review contracts with vendors and prepare the incident response.
Guides: DPIA · Vendor contracts · Breaches
We leave policies, roles and training in place to sustain compliance.
Guide: Privacy policy
Legal advice, processes, platform and ongoing support. We coordinate every part of the project, from the diagnosis to operation.
Two connected stages, from the diagnosis to going live.
We assess processing activities, risks and legal, operational, technology and data gaps.
We rank the findings by risk and business impact.
We define what to do first, who leads it and which solution fits.
Legal and operational implementation: contracts, policies, consents, training and technology enablement.
And we stay with you. Local support, updates and guidance to sustain compliance in day-to-day operations.
We help you choose the right one for the size and maturity of your organization.
SMEs and mid-market
Enterprise
We are AlayIAtrust, the Alaya Digital Solutions subsidiary specialized in personal data protection. We bring the group's experience to implementing compliance in your organization.
Meet the team that works with you →Since 2002, working with large organizations in Chile.
Consultants who know the local context, with direct support in Chile.
Experience in regulated sectors and high-data-volume operations.
Governance, security and digital transformation for large organizations.
A team that connects legal expertise, technology and management.
Luis Sepúlveda
General Manager · CEO
Joanna Davidovich
Director
Emilio Oñate
Board Advisor
Guillermo Aspée
Projects Manager
Manuel Labbé
Privacy Consultant
Mateo Hirmas
Commercial Manager
Pamela Cifuentes
Project Lead
Board and executive team. A subsidiary of Alaya Digital Solutions, in Chile since 2002.
Because location data does not describe a transaction, but a person's life: where they live, work, and move. When combined with traffic data, its sensitivity grows. Processing it requires a clear legal basis, transparent information for the data subject, and, depending on the risk, an impact assessment that justifies and limits that use.
Volume is governed with process, not individual effort. We define how access, rectification, deletion, objection, and portability requests are received, validated, routed, and answered across all your channels, supported by a record of processing activities (RoPA) that shows where each data point lives. That way you respond consistently and demonstrably, without relying on each team's memory.
It is the reality of the sector and the focus of our work. Fragmentation across activation, billing, network, support, and marketing makes it hard to know what is processed and for how long. We map those flows and reflect them in the RoPA, which also brings order to retention, deletion, and breach response when a system is affected.
No. The legal date in force is December 1, 2026. A bill before the Senate (Bill 18.623-07) proposes moving it to December 1, 2027, but that would only change if it is passed and published in the Diario Oficial.
The initial diagnosis is free. It is a 30-minute meeting to review where you stand against the law and agree on next steps. If you need a full analysis, we do it in the comprehensive assessment.
It depends on size and scope. The comprehensive assessment takes about 21 business days. Implementation takes 1 to 4 months for an SME solution and 3 to 6 months for an enterprise one. That is why it pays to start early.
Up to 5,000 UTM for minor violations, 10,000 UTM for serious ones and 20,000 UTM for the most serious (article 35). If a company that is not a smaller enterprise repeats a serious or most serious violation, the fine can reach 2% or 4% of its annual revenue.
The Personal Data Protection Agency can review your legal bases, the record of processing activities, the handling of ARSOP rights, breach management and compliance documentation.
Each industry processes different data and faces its own risks. See the approach for yours.
Start with a diagnosis. In 30 minutes we review your situation and the next steps, or we show you the platform in action. No commitment.
