Chile data protection law: licensing records under Ley 21.719

Which Chilean data protection law applies to your records today?#

Until November 30, 2026, the current text of Ley 19.628 on the protection of private life governs records about people in Chile. From December 1, 2026, the version of Ley 19.628 rewritten by Ley 21.719 applies, unless Congress moves that date.

Ley 21.719 was published in the Diario Oficial on December 13, 2024. It regulates the protection and processing of personal data and creates the Agencia de Protección de Datos Personales. It does not sit beside the old statute as a separate code: it amends Ley 19.628 and replaces most of its articles, so lawyers cite the new rules by their Ley 19.628 article numbers. Its first transitory article sets entry into force on the first day of the twenty-fourth month after publication, which is December 1, 2026.

That date is not fully settled. In a message dated August 31, 2026, the government asked the Senate, through Boletín 18.623-07, to postpone entry into force of the Ley 21.719 amendments to December 1, 2027. The Senate portal lists it in its first constitutional stage, in committee. A license negotiated in late 2026 can therefore fall under either regime, and the delivery date matters as much as the signing date.

Behind both texts sits Article 19 No. 4 of the Constitution, which since Ley 21.096 of 2018 protects personal data and says its processing is governed by the form and conditions the law sets.

Does Chile's law reach a U.S., Canadian or EU company?#

Often, yes. Article 1 bis of the amended law applies when the controller (responsable) or processor (mandatario) is established in Chile, when a processor abroad works for a controller established in Chile, and when a controller not established in Chile processes data to offer goods or services to people in Chile, with or without payment, or to monitor their behavior there, including analysis, tracking, profiling or prediction.

Common fact patterns for a foreign company: a Chilean subsidiary that runs sales or service, a support or shared-service team in Santiago, customers or app users in Chile, or a field operation there. Each points to a different controller and a different set of notices, so map which legal entity collected the records and under which privacy notice before anything else.

A controller without a domicile in Chile that processes data of people who live there must also keep an email address or other suitable contact channel up to date for data subjects and the Agency. That is a small duty, but it is a signal that the law expects foreign controllers to be reachable.

What counts as personal data, and when is a dataset outside the law?#

Personal data is information about an identified or identifiable natural person; a dataset leaves the law only when it has been anonymized. The amended law defines anonymization as an irreversible procedure after which the data cannot be linked or associated with a specific person or allow identification, because the link to the identifying information has been destroyed or removed. Anonymized data stops being personal data.

Pseudonymization is different. Pseudonymized data can no longer be attributed to a person without additional information, provided that information is kept separately under technical and organizational measures. It is still personal data, so a dataset where names are replaced with tokens and the key is retained stays inside the law. Hashing an email address is usually closer to pseudonymization than anonymization.

The current text uses older vocabulary: a dato estadístico is data that, at origin or after processing, cannot be associated with an identified or identifiable person, and disociación is processing that produces information that cannot be associated with a determined or determinable person. Under either text, the practical test is the same: keep the method, the residual fields and the re-identification test results on file.

Sensitive data needs separate handling. The amended definition is broader than the old list and includes health, biometric data, sex life, sexual orientation and gender identity. Knowingly processing, communicating or transferring sensitive data or data about children and adolescents outside what was consented or authorized by law is classed as a serious infringement.

Which legal basis can cover licensing records for AI training?#

Usually consent that named the use, or a documented legitimate interest; an old service or sales notice rarely covers it. Under the amended Article 12, consent must be free, informed and specific as to its purposes, given in advance and unequivocally, and it can be withdrawn at any time without giving a reason. The controller carries the burden of proving consent existed.

Article 13 lists cases where processing is lawful without consent, including when it is necessary for the legitimate interest of the controller or a third party, provided the data subject's rights and freedoms are not affected. The data subject can always ask to be told about the processing and the legitimate interest behind it. A commercial license of identifiable records is a hard case for that test; counsel should write down the balancing before relying on it.

The purpose principle in Article 3 adds a second hurdle: data must be collected for specific, explicit and lawful purposes, and processing is limited to those purposes, with narrow room for compatible uses. The law presumes a legitimate interest for processing done exclusively for historical, statistical, scientific or research purposes that serve the public interest. Do not assume a commercial training license fits that presumption without counsel's written view.

Under the current text, the rule is stricter on form: processing needs legal authorization or the person's express consent, given in writing after being told the purpose. Use the table to sort sources.

Is delivering a dataset to a buyer a cesión of personal data?#

If the delivery still contains personal data and the buyer will use it for its own purposes, treat it as a cesión under the amended Article 15. Personal data may be ceded with the data subject's consent and to fulfil the purposes of the processing. If the consent given at collection did not cover the cesión, it has to be obtained before the cesión happens.

The cesión must be recorded in writing or by a suitable electronic means, identifying the parties, the data ceded and the intended purposes, and the recipient (cesionario) must process the data only for those purposes. Consent is not the only route: a cesión can also rest on the performance of a contract to which the data subject is a party, on a legitimate interest of the transferor or recipient under Article 13 letter d, or on a legal provision.

The consequence of getting this wrong falls on both sides. A cesión made without consent where consent was required is void, and the recipient must delete all the data received, without prejudice to other liability. For a buyer that has already trained on the data, that is a serious risk, which is why buyers ask suppliers for the consent and basis analysis before delivery.

Keep four permissions apart: system access, privacy permission, ownership and contractual licensing rights. Chilean consent covers only the privacy permission, and anonymization does not by itself create a right to license.

Which international transfer route applies when the buyer is in the United States?#

From December 1, 2026, a transfer abroad needs one of the routes in Articles 27 and 28, on top of a lawful basis for the processing itself. The main routes are a destination country with an adequate level of protection, or instruments with adequate safeguards such as contractual clauses or binding corporate rules.

A country is adequate when its legal framework meets standards similar to or higher than Chile's law; the Agency decides this by reasoned decision and must publish a list of adequate countries and model contractual clauses on its website. Clauses and other instruments the Agency approves need no further safeguard or authorization. When neither adequacy nor safeguards exist, a specific, non-habitual transfer can rest on the data subject's express consent, and the Agency can authorize a particular transfer by reasoned resolution.

The transferring controller must be able to show the Agency that the transfer met the law, and the Agency can issue recommendations, adopt protective measures and, in qualified cases, temporarily suspend transfers. Inside a corporate group using binding corporate rules, the transferring controller answers for breaches by other group members unless it proves the breach was not attributable to them.

As of October 13, 2026 we found no published Agency list of adequate countries and no approved model clauses, which is expected before the law starts. Do not assume the United States, Canada or any EU state will be on the list. Counsel should confirm the list and any approved clauses on the delivery date.

What can the Agency do if a company gets it wrong?#

The Agency can investigate and fine on a three-level scale. Under the amended Article 35, minor infringements carry a written warning or a fine of up to 5,000 UTM, serious infringements up to 10,000 UTM, and very serious infringements up to 20,000 UTM; the UTM is Chile's monthly tax unit. Repeat offenses can draw up to three times the original amount.

For companies that are not small businesses and repeat serious or very serious infringements, the fine can reach the higher of the UTM amount and a share of the prior calendar year's annual income: 2 percent for serious and 4 percent for very serious infringements. Fraudulent processing of personal data is listed among the very serious infringements.

Two other features matter for a licensing file. Controllers must report security breaches that create a relevant risk to the Agency without undue delay and keep a register of incidents. And controllers can voluntarily adopt an infringement prevention model: Decreto 662 of 2026 sets the requirements for implementing, certifying, registering and supervising those models, and a certified model is recorded in the Registro Nacional de Sanciones y Cumplimiento kept by the Agency. Appointing a data protection officer is optional under the law but is a required element of such a model.

What should a Chile licensing file contain before delivery?#

A file that would let counsel, a buyer or the Agency follow the decision from collection to delivery. The list below is a practical starting point, not the Agency's minimum, and it works under either regime.

• 1Entity map: which company collected the records, where it is established, and whether Article 1 bis reaches it.
• 2Notice and consent evidence by source: the text shown, how consent was captured, dates, and a sample of stored records.
• 3Purpose analysis comparing the collection purposes with licensing and model training, plus any legitimate-interest balancing.
• 4Sensitive-data screen: health, biometric, sexual orientation, gender identity and children's data excluded or separately justified.
• 5Anonymization record: method, fields removed or generalized, re-identification test results, and who performed them.
• 6Cesión terms: parties, data, permitted purposes and the recipient's duty to stay within them.
• 7Transfer analysis: destination, Agency adequacy list checked and dated, clauses or other safeguards relied on.
• 8Timing record: signing date, delivery date, which text of Ley 19.628 applied, and the status of Boletín 18.623-07 on the delivery date.
• 9Contact channel for data subjects and the Agency if the controller has no domicile in Chile.

Spanish-to-English glossary for Chile's data protection law#

Chilean counsel and buyers will use Spanish terms that do not map one to one onto GDPR or U.S. vocabulary. Keep the Spanish term next to the working English in your file.

How this fits a licensing process#

Records about people in Chile come down to four questions before any data moves: which text of the law applies on the delivery date, what basis covers the new purpose, whether the delivery is a cesión, and which transfer route applies. If any answer is no or unclear, the usual options are to exclude those records, aggregate them, anonymize them to the irreversible standard, or seek fresh consent.

SourceX runs sourcing and qualification, rights review, contracting, data preparation, delivery and payment for businesses licensing operational data to AI developers. It works with U.S., Canadian and EU companies that had 50 or more full-time employees at their peak. The company approves exactly what is released, once per deal, and de-identification is performed by SourceX directly or through its processing partner.

None of that replaces Chilean counsel's view of the basis and transfer for your specific records. The first step is a short company assessment, and no data uploads are needed to see if a company qualifies.

SourceX can consider companies in Chile when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.