Chile’s Senate approves delaying the Data Protection Law to October 2027

On October 28, 2026, Chile's Senate approved the bill that delays the entry into force of Law 21.719, on personal data protection, from December 1, 2026 to October 15, 2027. The Chamber of Deputies still has to approve it and it still has to be published. Until then, the legal date remains December 1, 2026.

What was approved

• New proposed date: October 15, 2027. The government had asked for December 1, 2027; after an agreement with senators it accepted a shorter delay, according to Emol (in Spanish).
• Vote: 33 in favor and 6 against, according to Emol and La Tercera (in Spanish).
• Personal Data Protection Agency: its board grows from three to five members, with six-year terms, no reappointment and partial renewal every two years, appointed with the agreement of two-thirds of the Senate. According to Garrigues (in Spanish), the first appointments must be made no later than nine months before the law takes effect, that is, by January 15, 2027, according to Diario Financiero (in Spanish).
• Smaller companies: the bill keeps the rule that, during the first 12 months, the Agency may issue them written warnings instead of fines. The government had proposed extending that period to companies of every size, but the Senate's Constitution Committee kept it for smaller companies only, according to Diario Financiero.
• Reasons: the government cited the complexity of setting up the new institutions and the need for extra time for a gradual, coordinated rollout, according to Garrigues and Emol.

Where it stands

The bill (bulletin 18.623-07) has moved to the Chamber of Deputies for its second constitutional stage. Until both chambers approve it and it's published in the Official Gazette, Law 21.719 keeps its original date: December 1, 2026. If the process isn't finished by then, the law would take effect on that date.

What doesn't change

The delay only moves the date. The law's obligations stay the same: legal bases for processing data, individuals' rights, a duty of security, breach notification to the new Agency, and fines that, according to published guides, reach 20,000 UTM (a Chilean inflation-indexed unit) and, for repeat offenses, a percentage of annual revenue.

What to do with the extra year

An extra year isn't a free year. It's time to do properly what would otherwise be done in a rush:

1. Data inventory: what personal data you hold, where it lives, what you use it for and who can access it.
2. Legal bases and notices: review consents, contracts and privacy policies.
3. Security: access controls, backups and a procedure to detect and report breaches.
4. Suppliers: check which third parties process data on your company's behalf and what the contracts say.
5. Individuals' rights: how you'll handle requests for access, correction, deletion or objection.
6. Don't stop what's under way: organizations already adapting should keep going; the date could still be December 1, 2026 if the Chamber doesn't pass the bill in time.

If your company wants to use this window to get its data and security in order, ITLab can help. See also Chile's Data Protection Law: First Practical Tasks. Contact us.

Sources

• Garrigues, on the Senate's approval (in Spanish) (October 2026).
• Emol, on the Senate's approval (in Spanish) (October 29, 2026).
• Diario Financiero, on the Senate's approval (in Spanish) (October 28, 2026).
• La Tercera, on the Senate's approval (in Spanish) (October 29, 2026).