Sign in

Chile Act 19.628

Act 19.628 on the protection of private life — Ministry of the Secretariat General of the Presidency (Chile)

Also known as: Ley 19.628, Ley 19628, Act 19628, Ley sobre Proteccion de la Vida Privada, Chile data protection law

Official site Official change log Subscribe to Chile Act 19.628 (RSS)

Current version
Ley 19.628 (version in force from 9 May 2023)
Published 9 May 2023. source
Status
In force
Next deadline
in 22 days
Ley 21.719 amendments to Ley 19.628 take effect, with the new Agencia de Protección de Datos Personales, breach reporting and fines of up to 20,000 UTM source
Who must comply
Processing of personal data in registers or databases by public bodies and private persons; from 1 December 2026, all processing of personal data under the rules rewritten by Ley 21.719. source source
How it is assessed
Controllers answer data subjects' requests themselves today; from December 2026 they must also report security breaches to the new Agency. source
Authority
Until 30 November 2026 enforced through the courts; Ley 21.719 creates the Agencia de Protección de Datos Personales, which supervises and sanctions from 1 December 2026. source source
Enforced by
Today courts can fine controllers up to 50 UTM; from 1 December 2026 the Agency can fine up to 20,000 UTM, or up to 4% of annual revenue for large repeat offenders. source
Last change
None recorded yet

Chile's data protection statute. It governs the processing of personal data in public and private registers and databases, and is the act every organisation handling Chilean personal data answers to.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

Add these dates to your calendar
  1. in 22 days Ley 21.719 amendments to Ley 19.628 take effect, with the new Agencia de Protección de Datos Personales, breach reporting and fines of up to 20,000 UTM
  2. Ley 21.719 on personal data protection is published in the Diario Oficial

Amendments

  1. Ley 19.628 (version in force from 9 May 2023) AmendmentCurrent text

    Amendment by Ley 21.504 of 10 November 2022 (Ministry of Health) took effect. source

  2. Ley 19.628 (version in force from 26 August 2020) Amendment

    Amendment by Ley 21.214 of 28 February 2020 (Ministry of Education) took effect. source

  3. Ley 19.628 (version in force from 17 February 2012) Amendment

    Amendment by Ley 20.575 (Ministry of Economy) took effect. source

  4. Ley 19.628 sobre protección de la vida privada Major version

    Promulgated on 18 August 1999 and published on 28 August 1999. source

Who it applies to

The current text governs personal data in registers or databases held by public bodies and private persons; Ley 21.719 widens and rewrites the rules from 1 December 2026.

Current scope
Processing of personal data in registers or databases by public bodies or private persons is subject to the law, except in the exercise of freedom of expression and information (Article 1). source
From 1 December 2026
The amendments in Article 1 of Ley 21.719 take effect on the first day of the 24th month after its publication; LeyChile records that date as 1 December 2026. source

How compliance is assessed

Controllers answer data subjects' requests themselves today; from December 2026 they must also report security breaches to the new Agency.

Data subject rights
Anyone may demand information about their data from the person responsible for a database, and correction, deletion or blocking where the law allows (Article 12). source
Breach reporting (2026)
From 1 December 2026, controllers must report to the Agency, by the most expeditious means and without undue delay, breaches of security measures that destroy, leak, lose or alter personal data, where there is a reasonable risk to data subjects' rights and freedoms (Article 14 sexies). source

Enforcement and penalties

Today courts can fine controllers up to 50 UTM; from 1 December 2026 the Agency can fine up to 20,000 UTM, or up to 4% of annual revenue for large repeat offenders.

Up to 4% of annual revenue (from 2026)

Article 35 as rewritten by Ley 21.719: for companies other than small and medium enterprises that reoffend in very serious infractions; up to 2% for serious ones. source

Up to 20,000 UTM (from 2026)

Article 35(c) as rewritten by Ley 21.719, for very serious infractions; up to 10,000 UTM for serious and 5,000 UTM for minor ones. source

1 to 50 UTM (current)

Article 16: a court fine of 1 to 10 UTM, or 10 to 50 UTM for infringements of Articles 17 and 18 on financial, economic, banking or commercial data. source

Courts today
If the controller does not answer a request within two business days or refuses it, the data subject can go to the civil court, which can order compliance and impose a fine (Article 16). source
Damages
The person responsible for the database must compensate material and moral damage caused by improper processing (Article 23). source

Documents

  1. Law text Ley 19.628 sobre protección de la vida privada (LeyChile)
  2. Law text Ley 19.628, text with deferred effect from 1 December 2026
  3. Law text Ley 21.719, regula la protección y el tratamiento de los datos personales

Frequently asked questions

When does Chile's new data protection law take effect?

Ley 21.719, published on 13 December 2024, rewrites Ley 19.628 with effect from 1 December 2026. source

What are the fines under Chile's Ley 21.719?

Up to 5,000 UTM for minor, 10,000 UTM for serious and 20,000 UTM for very serious infractions; large companies that reoffend can be fined up to 2% or 4% of annual revenue (Article 35, in force from 1 December 2026). source

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 21 September 2026. Subscribe to Chile Act 19.628 (RSS)