Law 19.628: the Data Law in Force Today, and How Law 21.719 Rewrites It
Published in 1999, Law 19.628 on the protection of private life is still the law that governs personal data in Chile. Knowing what it demands today, and what its rewrite demands tomorrow, is the difference between complying with the law in force and preparing for the one that arrives.
Last updated:
Law 19.628 of 1999 is Chile's data protection law in force today: it requires legal authorization or consent to process personal data, grants rights of access, rectification, cancellation and blocking, and is enforced before the civil courts. Law 21.719 rewrites it with principles, an Agency and fines of up to 20,000 UTM.
What Law 19.628 governs today
The law organizes the processing of personal data in five parts: the use of personal data (Title I), the rights of data subjects (Title II), the communication of economic, financial, banking and commercial obligations (Title III), processing by public bodies (Title IV) and liability for infringements (Title V). Its enforcement model is judicial: if a controller ignores or denies a request, the data subject goes before the civil judge under the summary procedure of Article 16, and Article 23 adds liability for pecuniary and moral damage caused by improper processing.
Title III explains the law's popular nickname, the "DICOM Law". Articles 17 and 18 define which unpaid obligations may be reported to commercial bulletins (protested bills of exchange, promissory notes and cheques, and defaults on certain loans) and set two hard limits: no reporting after five years from when the obligation became enforceable, and no reporting once the debt is paid or otherwise extinguished.
The rewrite: Law 19.628 before and after Law 21.719
Law 21.719 does not repeal Law 19.628: it amends it and keeps the number. What changes is the substance of almost every rule that matters to a company.
| Dimension | Law 19.628 today | As amended by Law 21.719 |
|---|---|---|
| Authority | None: civil courts only (Article 16) | Personal Data Protection Agency, with supervisory and sanctioning powers |
| Sanctions | Damages actions; no general administrative fines | Fines up to 5,000 / 10,000 / 20,000 UTM plus a public sanctions registry |
| Lawful bases | Legal authorization or written consent | Modern catalogue: consent, contract, legal obligation, legitimate interest and more (Articles 12-13) |
| Rights | Access, rectification, cancellation, blocking | Expanded set including objection and portability, with response deadlines |
| Company duties | Secrecy and data quality, lightly specified | Information, security, breach notification, impact assessments, an optional data protection officer (DPO) and prevention model |
The full new regime is mapped in our Law 21.719 guide, the enforceable infringements in sanctions and fines, and what must be operating at entry into force in the deadline guide.
The dual-regime period
Until the amendments enter into force, companies live under the current Law 19.628 while preparing for its rewritten version. The date in force today is December 1, 2026, and a Government bill before the Senate (bulletin 18.623-07, filed with top-priority urgency) would move it to December 1, 2027. The practical reading does not change with the calendar: the processing inventory, the lawful bases and the rights procedures the new version demands take months to build, and the current version already punishes improper processing through damages.
Frequently asked questions
Is Law 19.628 still in force?
Yes. Law 19.628 on the protection of private life is the data protection law governing Chile today, in its current version. Law 21.719 rewrites it in depth, but those amendments enter into force on December 1, 2026, with a bill before the Senate (bulletin 18.623-07, under top-priority urgency) that would postpone them to December 1, 2027.
Does Law 21.719 repeal Law 19.628?
It does not repeal it: it amends it. Law 21.719 keeps the number 19.628 and replaces much of its content, adding principles, lawful bases, new rights, controller duties, the Personal Data Protection Agency and a fines regime. That is why modern citations read "Law 19.628 as amended by Law 21.719".
Which law applies to my company today?
Today, Law 19.628 in its current version applies: processing with legal authorization or consent, rights of access, rectification, cancellation and blocking, and claims before the civil courts (Article 16). There is no administrative supervisory authority yet, and no general administrative fines. That regime changes completely when the Law 21.719 amendments enter into force.
Why is it called the "DICOM Law"?
Because its Title III governs the communication of economic, financial, banking and commercial obligations, the information behind commercial credit bulletins. Articles 17 and 18 define which documents may be reported (protested bills, promissory notes and cheques, mortgage defaults, among others) and prohibit reporting debts already paid or enforceable more than five years ago.
When does the regime change?
The Law 21.719 amendments enter into force on December 1, 2026. The Government introduced in the Senate a bill moving that date to December 1, 2027 (bulletin 18.623-07, under top-priority urgency); until it passes and is published, the 2026 date governs. The substantive duties do not change with the postponement: what changes is when enforcement starts.
Official sources
- Law 19.628 on the protection of private life, current text (Articles 16-18 and 23 cited): BCN/LeyChile
- Law 21.719, which amends Law 19.628 and creates the Personal Data Protection Agency: BCN/LeyChile
- Bulletin 18.623-07, bill postponing the entry into force of the Law 21.719 amendments: Senado de Chile
Transform Your Legal Challenges into Competitive Advantages
Discover how our innovative approach can drive your business
