Chile

The territorial scope rule is article 1 bis of the rewritten law: it covers processing by a controller or processor established in Chile, processing carried out on behalf of a Chilean-established controller, and processing by anyone not established in Chile whose activity is aimed at offering goods or services to people in Chile or at monitoring, tracking, profiling or predicting their behaviour. The last paragraph of article 14 requires a controller with no address in Chile to keep an up-to-date and working email address or equivalent contact channel for data subjects and for the Agency. That is far lighter than the European Union's requirement to appoint an established representative. The law in force until 30 November 2026 has no territorial scope clause at all.

We searched for storage or residency mandates in banking, payments, insurance, securities, health, telecoms, government cloud, education, online gambling, mapping and defence, and found no rule requiring personal data to be stored in Chile. What the sectors do impose is different in kind: internet and telephone providers must keep one year of connection records available to prosecutors; health providers must keep patient files fifteen years and every entry in them counts as sensitive data; foreign financial technology firms must have an address in Chile to be registered; and organisations running essential services must alert the national cyber agency within three hours of a significant attack. From 1 December 2026, knowingly transferring data abroad in breach of the rules is one of the most serious categories of offence, punished by up to 20,000 monthly tax units, about 1.4 billion Chilean pesos or roughly 1.5 million US dollars, and up to 4 percent of annual Chilean sales for repeat offenders. No rule requiring data to stay in Chile was found in any sector, checked 18 August 2026, confidence medium for the sectors where the regulator's own rulebook could not be opened by machine.

Article 27 makes a transfer lawful where the destination is subject to a legal system with adequate protection, where contractual clauses or binding corporate rules with adequate guarantees are in place, or where sender and recipient adopt an approved compliance model or certification. Without those, a one-off, non-routine transfer is allowed on narrow grounds: the person's express consent, specific banking, financial or stock market transfers, obligations under ratified treaties, cooperation agreements between public bodies, an express legal authorisation, international judicial cooperation, performance of a contract with the person, and urgent medical or public health needs. Article 28 says the Agency will publish the list of adequate countries and model clauses on its website, and that clauses it approves need no further guarantee or authorisation. Two things matter operationally: the list is empty today because the Agency has not been constituted, and article 28 also allows the Agency to authorise a single transfer by reasoned decision. Article 29 lets the Agency inspect transfers, make recommendations, take precautionary measures and in qualified cases temporarily suspend the flow of data.

Under the law in force today, enforcement runs through the civil court of the controller's home district. The fine range is one to ten monthly tax units, or ten to fifty for breaches of the credit reporting rules. That is why enforcement is rated as waking rather than active: the text has existed since 1999 and produces almost no deterrent. From 1 December 2026 the Agency is a decentralised public service run by a three-member board, with its own investigation and sanction procedure, a public national register of sanctions and compliance, and the power to suspend a company's data processing for up to thirty days after repeated most-serious offences. Two other bodies already enforce in adjacent areas: the National Cybersecurity Agency, created by the 2024 framework law on cybersecurity, and the Financial Market Commission, which supervises banks, insurers, securities firms and registered financial technology providers. The Transparency Council supervises public bodies under the freedom of information law. We could not confirm the current staffing of the National Cybersecurity Agency because its website refused automated access on 18 August 2026.

Floor. The Code of Criminal Procedure requires public telecommunications companies and internet providers to hold, confidentially and at the disposal of prosecutors, an updated list of their authorised internet address ranges and a record of at least one year of the connection addresses their subscribers use, together with traffic data and subscriber addresses, and to destroy that material securely once the maximum period ends. Health providers must keep the patient file for at least fifteen years, and the whole file counts as sensitive data. Ceiling. The rewritten law's proportionality principle allows data to be kept only for as long as the purpose requires, after which it must be deleted or anonymised, unless a law says otherwise or the person consents to longer. Credit and commercial default data may not be communicated more than five years after the debt fell due, and may not be communicated at all once the debt is paid. The rewritten law resolves conflicts in favour of the specific legal duty: the deletion right does not apply where another legal obligation or a court decision requires the data to be kept.

The cybersecurity framework law sets the three-hour early alert from the moment you become aware of an attack or incident that may have significant effects, a seventy-two hour update with an initial assessment and any indicators of compromise, and a final report within fifteen calendar days of the early alert. An operator of vital importance whose essential service is actually disrupted must deliver the update within twenty-four hours instead of seventy-two. The personal data breach duty has no fixed deadline in hours, which sounds generous and is not: the wording is by the fastest possible means and without undue delay, and deliberately failing to report is a most-serious infringement. You must also keep an internal register of each breach describing what happened, the effects, the categories and approximate number of people affected and what you did about it. Where individual notice is impossible, notice must be published in a mass national medium.

The children's thresholds are unusual: under fourteen is a child, fourteen to seventeen is an adolescent processed under adult rules, and sensitive data about adolescents under sixteen needs parental consent. Rights requests generally get thirty calendar days, extendable once by thirty, but a request to temporarily block processing must be answered within two working days and, until you answer, you may not process that person's data at all. On credit data, the creditor must tell the credit register within seven working days of payment and downstream users must update within three days or block the record. On the fourth trap, the rewritten law puts the Senate, the Chamber of Deputies, the judiciary, the Comptroller General, the Central Bank, the Public Prosecutor, the Electoral Service and the National Television Council under a separate self-regulating regime, and the cybersecurity law says the same bodies are not subject to the cyber agency's supervision. On the fifth, the casino law states in terms that an operating permit never covers online games of chance, so anyone offering online betting to Chileans is operating outside the licensing system.

Dormant switches. First, the Agency alone decides which countries count as adequate and which model contracts are acceptable, so it can widen or narrow cross-border flows by publishing a list. Second, the Agency may suspend a specific data flow abroad as a precaution, and may suspend a company's processing entirely for thirty days after repeated most-serious offences, renewable indefinitely if the company does not comply. Third, the cybersecurity agency designates which companies are operators of vital importance, and that designation doubles the maximum fines and tightens the incident deadline from seventy-two to twenty-four hours. Also pending: the regulations the law requires, which were due within six months of publication, and one further transitional detail we could not resolve, namely that the official consolidated text shows the transitional article on appointing the board was amended with effect from 5 February 2026, and we could not identify the amending law. The date the substantive rules start was not amended.