Chile

The rule on who is covered is article 1 bis of the rewritten law. It covers any company established in Chile that uses personal data, and any supplier established in Chile. It covers work done on behalf of a company established in Chile. And it covers anyone not established in Chile whose activity aims at people in Chile. That means offering them goods or services. It also means monitoring, tracking, profiling or predicting their behaviour. The last paragraph of article 14 covers a company with no address in Chile. It must keep an up-to-date, working email address, or an equivalent contact channel, for the people whose data it holds and for the Agency. That is much lighter than Europe's requirement to appoint an established representative. The law in force until 30 November 2026 says nothing at all about who it covers by territory.

We looked for rules requiring data to stay in Chile in banking, payments, insurance, securities, health, telecoms, government cloud, education, online gambling, mapping and defence. We found none. What industries do impose is different. Internet and telephone providers must keep one year of connection records available to prosecutors. Health providers must keep patient files for fifteen years, and every entry counts as sensitive data. Foreign financial technology firms must have an address in Chile to be registered. Organisations running essential services must alert the national cyber agency within three hours of a significant attack. From 1 December 2026, knowingly sending data abroad in breach of the rules is one of the most serious offences. It is punished by up to 20,000 monthly tax units. That is about 1.4 billion Chilean pesos, or roughly 1.5 million US dollars. Repeat offenders can be fined up to 4 percent of annual Chilean sales. We found no rule requiring data to stay in Chile in any industry, checked 18 August 2026. Confidence is medium for the industries whose regulator's rulebook we could not read automatically.

Article 27 allows a transfer in three cases. The destination is under a legal system that protects data well enough. Or contract clauses, or binding corporate rules, with adequate guarantees are in place. Or sender and recipient adopt an approved compliance model or certification. Without those, a one-off transfer that is not routine is allowed on narrow grounds. The person's express consent. Specific banking, financial or stock market transfers. Duties under ratified treaties. Cooperation agreements between public bodies. An express legal authorisation. International judicial cooperation. Performing a contract with the person. And urgent medical or public health needs. Article 28 says the Agency will publish the list of safe countries and the model clauses on its website. Clauses it approves need no further guarantee or authorisation. Two things matter day to day. The list is empty today, because the Agency has not been set up. And article 28 also lets the Agency approve a single transfer by reasoned decision. Article 29 lets the Agency inspect transfers, make recommendations, take precautionary measures, and in serious cases suspend the flow of data for a time.

Under the law in force today, enforcement runs through the civil court of the district where the company is based. The fine range is one to ten monthly tax units. For breaches of the credit reporting rules it is ten to fifty. That is why we rate enforcement as waking up rather than active. The text has existed since 1999 and deters almost nobody. From 1 December 2026 the Agency becomes a decentralised public service run by a three-member board. It gets its own investigation and penalty process. It gets a public national register of penalties and compliance. And it can stop a company using personal data for up to thirty days after repeated most-serious offences. Two other bodies already enforce in nearby areas. The National Cybersecurity Agency, created by the 2024 cybersecurity law. And the Financial Market Commission, which supervises banks, insurers, securities firms and registered financial technology providers. The Transparency Council supervises public bodies under the freedom of information law. We could not confirm the current staffing of the National Cybersecurity Agency, because its website refused automated access on 18 August 2026.

MINIMUMS. The Code of Criminal Procedure covers public telecommunications companies and internet providers. They must hold, confidentially and available to prosecutors, an up-to-date list of their authorised internet address ranges. They must also hold a record of at least one year of the connection addresses their subscribers use, with traffic data and subscriber addresses. They must destroy that material securely once the maximum period ends. Health providers must keep the patient file for at least fifteen years, and the whole file counts as sensitive data. MAXIMUMS. The rewritten law says you may keep data only as long as the purpose requires. After that you must delete it or make it anonymous. The exceptions are a law saying otherwise, or the person agreeing to longer. Credit and commercial default data may not be shared more than five years after the debt fell due. It may not be shared at all once the debt is paid. The rewritten law settles clashes in favour of the specific legal duty. The right to have data deleted does not apply where another law, or a court decision, requires the data to be kept.

The 2024 cybersecurity law sets three deadlines. An early alert within three hours of you becoming aware of an attack or incident that may have significant effects. An update at seventy-two hours, with an initial assessment and any indicators of compromise. And a final report within fifteen calendar days of the early alert. An operator of vital importance whose essential service is actually disrupted must send the update within twenty-four hours instead of seventy-two. The personal data breach duty sets no deadline in hours. That sounds generous and is not. The wording is by the fastest possible means and without undue delay, and deliberately failing to report is a most-serious offence. You must also keep an internal register of each breach. It must describe what happened, the effects, the kinds and rough number of people affected, and what you did about it. Where you cannot notify people individually, you must publish notice in a national mass medium.

The age limits are unusual. Under fourteen is a child. Fourteen to seventeen is an adolescent, handled under adult rules. But sensitive data about an adolescent under sixteen needs a parent's consent. Rights requests normally get thirty calendar days, which you can extend once by another thirty. A request to temporarily block use of someone's data must be answered within two working days. Until you answer, you may not use that person's data at all. On credit data, the creditor must tell the credit register within seven working days of payment. Anyone using that data downstream must update within three days, or block the record. On the fourth trap, the rewritten law lets several bodies write their own privacy rules. They are the Senate, the Chamber of Deputies, the judiciary and the Comptroller General. They also include the Central Bank, the Public Prosecutor, the Electoral Service and the National Television Council. The cybersecurity law says the same bodies are outside the cyber agency's supervision. On the fifth, the casino law says in terms that an operating permit never covers online games of chance. So anyone offering online betting to Chileans is operating outside the licensing system.

Powers already held. First, the Agency alone decides which countries count as safe enough, and which model contracts are acceptable. So it can widen or narrow cross-border flows just by publishing a list. Second, the Agency may suspend a specific data flow abroad as a precaution. It may also stop a company using personal data entirely for thirty days after repeated most-serious offences. It can renew that indefinitely if the company does not comply. Third, the cybersecurity agency decides which companies are operators of vital importance. That label doubles the maximum fines and tightens the incident update deadline from seventy-two hours to twenty-four. Also pending: the regulations the law requires, which were due within six months of publication. One transitional detail we could not resolve. The official consolidated text shows the transitional article on appointing the board was amended, with effect from 5 February 2026. We could not identify the amending law. The date the main rules start was not amended.