Key Week for Chile's Data Law: Prevention-Model Regulation Cleared and a Bill Postponing Entry into Force to 2027

In three days, two events reshaped the timeline of Law 21.719: the Comptroller General cleared the infringement prevention model regulation (Supreme Decree No. 662) and the Government introduced in the Senate a bill postponing entry into force to December 1, 2027.

In three days, two events reshaped the timeline of Law 21.719, Chile's data protection law.

On August 28, 2026, the Comptroller General completed the legal review (toma de razón) of Supreme Decree No. 662 of the Ministry of Finance, which approves the regulation of the infringement prevention model under articles 49 to 53. Only publication in the Official Gazette remains. The regulation details the compliance program's elements: a characterization of processing activities (a record of processing activities satisfies it), a risk matrix graduated by infringement severity, protocols, an internal reporting channel protecting the whistleblower's identity, internal sanctions and a data protection officer, whose appointment is mandatory within the model. Agency certification lasts three years, renewable, and implementation may begin before the entity is entered in the registry.

On August 31, 2026, the Government introduced in the Senate the bill amending Law 21.719 (Message No. 110-374). It proposes three changes: it postpones entry into force from December 1, 2026 to December 1, 2027; it expands the Agency's Board from three to five members, with the first appointment due at the latest twelve months before entry into force; and it extends to all companies the Agency's power to close a first infringement with a written reprimand during the first twelve months, today reserved for smaller ones.

Two points matter. First, until Congress passes the bill and the amendment is published, the legal date remains December 1, 2026. Second, the bill touches no substantive duty: the processing inventory, the lawful bases, the rights procedures and the security measures are the same work at either date. A company that freezes its preparation only gives up the mitigating position the law grants to those who prepare early.

Our full analysis is in what must be operating at entry into force and in our Data Protection Officer guide.