The Infringement Prevention Model of the Data Law

One name, two different models

Chilean compliance practice already knows a “prevention model”: the crime prevention model of Law 20.393, which shields the company from criminal liability. This one is different. The infringement prevention model belongs to the data law, prevents administrative infringements rather than crimes, and its reward is a mitigated fine and a public certification, not a criminal exemption.

The two programs coexist without duplicating everything. The regulation expressly allows the internal reporting mechanisms of the data program to be integrated into reporting channels the organization already operates for other matters, provided they meet the requirements of Law 19.628 and the regulation (Article 3 g). A company with a working ethics channel builds on it; it does not start over.

The elements of the program (Article 3 of the regulation)

Article 3 lists the minimum content of every compliance program. The regulation scales the standard: protocols must weigh the operations the controller actually runs, the quantity and type of data it processes, and the company’s size and economic capacity.

The program does not live in a binder. The internal rules it generates must be expressly incorporated as an obligation into the employment and services contracts of all workers and providers, top executives included, and into the internal workplace regulations where applicable (Article 4). The controller must also communicate the program, and every update, to everyone in the organization (Article 5).

The officer inside the model

Appointing a data protection officer is voluntary in general, but mandatory within the adoption and certification of a compliance program (Article 6). The appointment belongs to the highest governing authority, the board, a managing partner or the top authority of the entity, and the officer reports directly to whoever appointed them, with autonomy from management (Article 8).

The regulation makes the figure workable at every scale: the officer may be an employee or an external provider under a services contract, one natural person may serve several controllers, a business group under the same controller may share a single officer, and in micro, small and medium-sized companies the owner may personally assume the role (Articles 7 and 8). The company must publish the officer’s contact details on its website and keep the Agency informed (Article 11).

Certification: three years, a public registry, and grounds to lose it

The Agency certifies programs that meet the law and the regulation, at the interested party’s request (Article 15). Certificates last three years and are renewable. Certified entities enter the National Registry of Sanctions and Compliance, where certificates are publicly accessible (Article 17), and implementation may begin before the entity is entered in the registry (Article 18).

One publicity rule deserves attention: the company may only advertise that its program is certified through a direct, plain reference to the National Registry (Article 5). Seals, badges and marketing claims beyond that reference are outside what the regulation authorizes.

Does it make sense to wait for the postponement?

The Law 21.719 amendments enter into force on December 1, 2026, with a Senate bill that would move them to December 1, 2027. The regulation, however, is already published, and Article 18 allows implementation to begin before registry entry. The underlying work does not change with the date: the processing inventory, the risk matrix, the protocols and the officer are the same effort in 2026 and in 2027. The company that builds the program early reaches the Agency’s first supervision cycle holding the mitigating position; the one that waits spends that time accumulating exposure.

Frequently asked questions