Law 21.719 modernizes personal data protection in Chile and creates the Personal Data Protection Agency, an autonomous body that will be able to audit, resolve complaints and impose sanctions.
When does it take effect?
The current date is 1 December 2026. The Government filed a bill in the Senate (Bulletin 18.623-07) to postpone it to 1 December 2027; as of mid-October 2026 it was still in its first reading, so unless it is approved, the 2026 date stands. We will update this article when it is resolved.
Main changes
- ARCOP rights: access, rectification, erasure, objection and data portability.
- Security by design and by default: measures in place before processing data, processing only what is strictly necessary for each purpose.
- Breach notification: security incidents that put people’s rights at risk must be reported to the Agency.
- Fines: up to 5,000 UTM for minor, 10,000 UTM for serious and 20,000 UTM for very serious infringements. For repeat offenses they can scale to a percentage of annual revenue.
What to review if you run public WiFi
A captive portal usually asks for an email or phone number, and the network logs connecting devices. Some useful questions:
- What data does the portal ask for, and why? Is it the minimum necessary?
- Do the terms and privacy policy explain the use clearly?
- Who is the data controller, and how can people exercise their rights?
- Is the public network isolated from the private one? Is there an incident procedure?
How Streetwifi is designed
At Streetwifi, technical browsing data is not linked to individuals, the public network is isolated from the home network with VLANs, and personal data is held by the entity that charges for the service (usually the ISP), which must comply with its country’s law. More in Security and privacy.
Sources: Carey: postponement bill · ProtecciónDatosWeb: bill status · CumpliAi: sanctions