Does Your Ecommerce Business Comply with Law 21.719? A Guide to Data Protection in Chile

On December 1, 2026, Law 21.719, Chile's new personal data protection regulation, will come into force. If you have a website or an ecommerce business in Chile, this regulation affects you. But it also applies to businesses that sell to people in Chile from outside the country.

In this article, we review what the law requires from your website, the risks of non-compliance, and how to prepare before December to ensure you meet all the requirements.

Who does it apply to?

The law applies to any individual or legal entity that processes personal data. The regulation also has an extraterritorial scope, meaning that even if your company is not established in Chile, the law applies to you if you:

• offer goods or services to people located in Chile;
• monitor the behavior of people in Chile, including analyzing, tracking, profiling, or predicting their behavior.

Therefore, if you are a Chilean ecommerce business or an ecommerce business with customers in Chile, this regulation will apply to you as of December.

The checklist:
What must your website have?

1. Free, informed, specific, prior, and unambiguous consent

This is one of the legal bases for data processing and one of the most important changes:

• No pre-checked boxes or implied consent. Users must express their willingness through a declaration or a clear affirmative action.
• Continuing to browse, closing the notice, or simply letting time pass does NOT constitute acceptance.
• You must inform users about what data you collect, the purposes for which it is processed, the processing period, whether it is shared with third parties, and how consent can be withdrawn.
• Withdrawing consent must be as easy as giving it. Users must be able to withdraw their consent at any time and without providing justification, free of charge and through a method that is as easy as giving consent.

Therefore, it is very important to carefully review your contact forms, user registration processes, purchasing processes, and newsletter subscriptions, as all of them will need to comply with these consent requirements.

2. An always-accessible data processing policy

Law 21.719 requires you to make the following information available to the public in a precise, clear, unambiguous, and free manner, at a minimum:

• the data processing policy, including its date and version;
• who the data controller is, their legal representative, and the data protection officer, if applicable;
• postal address, email address, contact form, or another means of receiving requests;
• the categories of data processed, recipients, purposes, and legal basis (and legitimate interests, where applicable);
• security policies and measures;
• data subjects' rights and their right to lodge a complaint with the Agency;
• transfers to third countries and whether they provide an adequate level of protection;
• the retention period and source of the data;
• the right to withdraw consent;
• the existence of automated decision-making, including profiling, together with meaningful information about the logic applied.

This is particularly relevant for ecommerce businesses because many stores use payment gateways, logistics providers, or marketing tools hosted outside Chile, which involves an international transfer of data that must be explicitly stated in your privacy policy.

3. Channels for exercising data subjects' rights

Users of your website have the rights of access, rectification, erasure, objection, portability, and blocking. Therefore, your ecommerce business must provide an email address, contact form, or equivalent electronic means through which they can submit their requests.

Deadlines matter:

• 30 calendar days to respond, extendable once for an additional 30 days.
• 2 business days to respond to a temporary blocking request, which may be submitted together with a request for rectification, erasure, or objection. Until the request is resolved, you may not process the affected data (although you may still store it).
• If you deny the request, in whole or in part, you must provide reasons for your decision and inform the data subject that they have 30 business days to file a complaint with the Agency.
• You must retain records demonstrating that the response was sent, including its date and full content.

Rectification, erasure, and objection rights are always free of charge, while the right of access is free of charge at least once every three months.

4. Security and privacy by design and by default

Data protection must be integrated from the outset into the design of your website and processes:

• Data minimization: by default, only data that is specific and strictly necessary for each purpose should be processed.
• Risk-appropriate measures, such as pseudonymization and encryption, the ability to ensure confidentiality, integrity, availability, and resilience, the ability to restore access to data following an incident, and regular assessment of the effectiveness of these measures.
• If a security breach occurs that poses a reasonable risk to data subjects' rights, you must report it to the Agency "by the most expeditious means possible and without undue delay." The law does not establish a specific deadline in hours or days. You must also keep records of these communications, and if the breach affects sensitive data, data belonging to children under 14, or economic, financial, banking, or commercial data, you must also notify the affected data subjects.

5. Protection of minors

If your website may be used by minors, you should pay particular attention to forms and registration processes:

• Processing the data of children under 14 requires the consent of their parents or legal representatives.
• Adolescents (over 14 and under 18) may consent in the same way as adults, except when it comes to their sensitive data if they are under 16, in which case parental consent is required.

What should the cookie banner look like?

The law does not regulate cookies by name, but its consent requirements fully apply to them. A cookie banner compliant with the new data protection regulations should meet the following requirements:

• Opt-in and privacy by default
• Accept and reject buttons with equal visual prominence.
• Granularity by purpose: separate necessary, analytics, personalization, and advertising cookies instead of using a single "accept all" option.
• Clear information before making a decision: purpose, retention period, whether data is shared with third parties, and a link to the data processing policy.
• Actual technical blocking: non-essential cookies must be blocked until a valid consent signal is received.
• Revocation must be as simple as acceptance.
• No cookie walls

What happens if you don't comply?

If you reach December 1, 2026 and your ecommerce business has not implemented all these changes, you may face penalties depending on the severity of the violation. The law classifies violations into three levels:

But there is more to consider:

• 50% surcharge on the fine if you fail to correct the conduct within the 60-day period established by the Agency.
• Repeat offenses: fines of up to three times the original amount. For companies that are not classified as small businesses and that repeat serious or very serious violations, the fine may reach 2% or 4% of annual revenue from sales and services, respectively.
• Suspension of data processing activities for up to 30 days if you accumulate repeated very serious violations within a 24-month period.
• Reputational damage: sanctions are recorded for five years in the National Register of Sanctions and Compliance, which is publicly and freely accessible. Your customers and competitors will be able to consult it.
• Compensation: if non-compliance causes financial or non-financial damage to a data subject, they may seek compensation.

Mitigating factors include, among others, voluntary self-reporting, cooperation with the investigation, remediation of the damage, no previous sanctions, and having a violation prevention model certified by the Agency.

An important detail for SMEs: during the first 12 months after the law comes into force, the Agency may impose a written warning as a sanction on companies classified as small businesses. This provides an opportunity to correct non-compliance, but it is not an exemption.

What you need to do before December 1

If you want to prepare your ecommerce business to comply with the new Law 21.719 on data protection, you should follow these steps:

1. Review your forms and remove any pre-checked boxes or implied consent.
2. Update or draft your data processing policy with all the minimum required information.
3. Set up a clear channel for exercising data subjects' rights and establish an internal procedure for meeting the deadlines.
4. Apply the data minimization principle and review your security measures (encryption, pseudonymization) and your breach response protocol.
5. Review your registration mechanisms if your website may be used by minors.
6. Adapt your cookie banner: opt-in, equally prominent accept and reject options, separate categories, and technical blocking of scripts.
7. Review your international data transfers (payment gateways, logistics, marketing) and reflect them in your policy.

How Lawwwing can help you comply with Law 21.719

At Lawwwing, we understand that adapting to all these regulations can be very complex, as it involves managing a large volume of data and continuously monitoring legislative developments.

That is why Lawwwing offers you a way to automate the adaptation of your website. Our software generates and keeps your legal texts up to date, including your data processing policy, legal notice, and cookie policy. We also provide you with a customizable cookie banner certified with Google Consent Mode v2 Gold category, allowing you to collect all consents lawfully. With Lawwwing, you can comply with the new Chilean Law 21.719 on data protection without having to worry about anything.

Don't wait until December. Adapt your website to Law 21.719 with Lawwwing.