Chile’s Data Protection Law: First Practical Tasks

Chile has Law 19.628 and Law 21.719, rules that address the protection and processing of personal data. Beyond the legal text, whose scope is determined by legal counsel, there are technical and housekeeping tasks any organisation can start.

• Knowing which personal data is processed, where and by whom is the first step.
• It helps to organise how requests from individuals and relationships with third parties are handled.
• General guidance; it does not replace legal advice.

First task: inventory

You cannot protect what you do not know. A simple inventory records what data about people the organisation handles (customers, employees, suppliers, applicants), which systems hold it, for what purpose it is used, who has access and how long it is kept. A tidy spreadsheet yields a useful first version. This is often called a record of processing activities.

Second task: handling individuals' requests

People may ask about or request changes to their data. Although the detail of their rights and procedures is for legal counsel, the organisation can define internally who receives a request, how it is logged and how a person's data is located across systems. A well-kept inventory makes this possible.

Third task: third parties and vendors

Much personal data sits with vendors: email, hosting, management systems, cloud services. List those third parties, identify which access personal data and review what security and confidentiality commitments exist. That list also helps when answering customer assessments.

Fourth task: basic technical measures

Controls such as multi-factor authentication, encryption, backups and access limits reduce exposure. So does using synthetic data in testing, as explained in Synthetic test data.

What to do

• Build the personal data inventory with an assigned owner.
• Define a channel and an owner for receiving individuals' requests.
• List vendors with access to personal data.
• Review access and backups of the systems holding that information.
• Consult legal counsel on the scope that applies to your organisation.

Frequently asked questions

Should my small business care about this law? Any organisation that processes data about people has reason to organise the subject; the specific scope is determined by legal counsel.

Is a website with a privacy policy enough? It is one part; internal order of the data is the foundation.

Who should lead the process? A designated owner, with support from management, IT and legal counsel.

A well-prepared vendor assessment complements this work; see Supplier security assessments.

In our work with Chilean organizations, we see that starting from the inventory of data and third parties organises the rest. Organizations we have supported have passed supplier security assessments required by their institutional customers.

IT Lab supports Chilean organisations in this. Contact us.