CHILE Law and Practice Contributed by: Patrick Humphreys, Daniela Gazmuri Larraín, Paula Lühr, Ian Hinzpeter, Camila Leviante, Beatriz Riveros and José Luis Bravo, Garnham Abogados
Data Protection Regulation (GDPR). It strengthens data subject rights, introduces clearer principles for processing, regulates international transfers in more detail, creates obligations relating to security incidents and impact assessments, and establishes a dedi - cated supervisory authority. For foreign companies, the practical message is that Chile is moving from a relatively light-touch privacy regime to a more active compliance model. In practice, businesses operating in Chile should use the transition period to map the personal data they collect, review consent and privacy notices, assess vendor and processor arrangements, and prepare procedures for handling data subject requests and security breaches. Companies that already comply with GDPR-type standards will be better positioned, but local review will still be needed because Chile - an rules will have their own scope, procedures and Chile’s current LPD is mainly framed around process - ing activities carried out in Chile and databases or operations connected with the country. In practice, a foreign company will usually need to consider Chilean data protection rules if it collects personal data from individuals located in Chile, contracts with Chilean customers, operates through a Chilean subsidiary or branch, or uses Chilean service providers to process personal data. The issue is becoming more important because digital business models often allow foreign companies to tar - get Chilean consumers without having a strong physi - cal presence in the country. E-commerce platforms, fintech businesses, software providers, online adver - tising networks and health or education platforms may all collect personal data from Chilean users. Even where enforcement has historically been limited, con - tractual, consumer protection and reputational risks can arise if privacy practices are not aligned with Chil - ean expectations. enforcement mechanisms. 8.2 Geographical Scope Application to Foreign Companies International Transfers and Practical Compliance Cross-border transfers are common in Chile, especial - ly where multinational groups use regional or global
systems for human resources, customer manage - ment, cloud hosting, analytics or cybersecurity. Com - panies should identify where Chilean personal data is stored, who can access it and whether third-party processors are located abroad. Law No 21,719 will make this analysis more important by introducing a more developed framework for inter - national data transfers and by empowering the new authority to oversee those transfers. Foreign busi - nesses targeting Chile should therefore prepare Chile- specific privacy notices, review intra-group transfer mechanisms and ensure that contracts with proces - sors clearly address confidentiality, security, permitted use of data and incident reporting. 8.3 Role and Authority of the Data Protection Agency Current Enforcement Position Chile does not currently have a single public data protection authority with broad supervisory and sanc - tioning powers comparable to European data protec - tion regulators. Enforcement under the current LPD has therefore been fragmented and, in many cases, dependent on court actions brought by affected indi - viduals. Some public bodies have limited powers that can touch on privacy issues. The Council for Transparency has a role in relation to public-sector transparency and access to information, including the protection of personal data held by public bodies. The National Consumer Service may also become involved where data practices affect consumers, for example in digital services, marketing, financial products or unfair con - tract terms. New Agency From 2026 Law No 21,719 creates the Data Protection Agency as a specialised public authority responsible for protect - ing personal data rights and supervising compliance with the amended LPD. The Agency is designed as a technical, decentralised and autonomous public body, linked to the President through the Ministry of Economy, Development and Tourism. Once the reform enters into force on 1 December 2026, the Agency will become the central regulator for
197 CHAMBERS.COM
Powered by FlippingBook