CHILE Law and Practice Contributed by: Claudio Magliona, Bárbara Reyes and Diego Lisoni, Magliona Abogados
and other requirements established by the Law would therefore be required. However, the New Law has a chapter dedicated to the international transfer of personal data, contemplating a wide catalogue of cases that would allow data trans - fers to be carried out under a dynamic framework. See 5.5 Recent Developments . 5.2 Government Notifications and Approvals No government notifications or approvals are required to transfer data internationally. For its part, according to the New Law, it is not neces - sary to request authorisation from the Personal Data Protection Agency to carry out an international trans - fer of data, except when some of the specific require - ments under which it is legal to carry out this type of activity have not been met. 5.3 Data Localisation Requirements Currently, the Law does not establish data localisation requirements, nor does the New Law provide for such limitations. However, under Chapter 20-7 of the Updated Compi - lation of Standards (RAN) on the outsourcing of ser - vices by financial institutions (especially banks), the data, technological platforms, and applications to be used in the outsourcing of services must be located at specific processing sites, and in the case of process - ing abroad, in a defined and known jurisdiction. In addition to jurisdiction, the city where the data centres operate is also required to be known. For the purpose of contracting any type of service through the modality called cloud computing, the board of directors of a financial institution must annually determine the level of risk tolerance that the financial institution is willing to assume in this type of outsourcing. This pronouncement must consider an analysis of the data to be stored or processed under this modality and its location. Without prejudice to the due fulfilment of the differ - ent requirements contained in Chapter 20-7, financial institutions may outsource their non-critical services to the public or private cloud. If the financial institu -
tion evaluates the contracting of a cloud service for an activity considered strategic or critical, this may also be carried out in public or private cloud mode. However, in these cases, the financial institution must carry out enhanced due diligence of the provider and the service. 5.4 Blocking Statutes There are no blocking statutes in Chile. 5.5 Recent Developments The New law, which will come into force in Decem - ber 2026, regulates international transfers of personal data in a specific manner, unlike the current Law in force. Thus, international data transfers will be legal in the following cases: • When the recipient of the data is in a country with adequate levels of data protection. • When the transfer is covered by contractual clauses or other legal instruments. • When the data controller and the recipient adopt a compliance model or certification mechanism. In the absence of an adequacy decision or adequate guarantees, a specific and unusual transfer may be made in the following cases: • express consent of the data owner; • bank, financial or stock market transfers; • compliance with international obligations; • international judicial co-operation; • conclusion or execution of a contract; and • urgent measures in medical or health matters. The Personal Data Protection Agency will be respon - sible for determining which countries have adequate levels of data protection. A country’s legal system will be deemed to have adequate levels of data protec - tion when it meets standards similar to or higher than those of Chile, taking into account at least whether the country has established principles governing the processing of personal data; the existence of regula - tions that recognise and guarantee the rights of data subjects and the existence of a supervisory authority; the imposition of information and security obligations; and the establishment of an infringement and liability regime.
45 CHAMBERS.COM
Powered by FlippingBook