Make your website comply with the new Chile's regulations before December

The cookie banner must follow an opt-in model, meaning that no non-essential cookies may be activated by default. Users must take a clear and affirmative action to accept cookies. The options to accept, reject, and configure cookies must be presented in an equally visible and accessible manner. Consent must be informed, granular, and reversible.

Data subjects must submit their requests to the organisation responsible for processing their personal data through the available channels, such as an online form, email address, or equivalent communication method. The organisation has 30 calendar days to respond, which may be extended by an additional 30 days if necessary.

An important exception applies to requests for temporary blocking. In these cases, the organisation must respond within two business days and may not continue processing the affected data while the request remains unresolved.

If the organisation rejects the request, either wholly or partially, the individual may file a complaint with the Personal Data Protection Agency.

The APDP is the new independent public authority created by Law No. 21,719 to oversee compliance with data protection legislation. Its powers cover three main areas:

• Regulatory Powers: It may issue binding regulations, interpret legal provisions, and propose legislative reforms.
• Supervisory Powers: It may request documentation from data controllers, summon individuals with relevant information, and audit compliance programmes.
• Enforcement Powers: It may impose fines, resolve complaints submitted by data subjects, and order the temporary suspension of data processing activities for up to 30 days in the most serious cases.
• The Agency is also responsible for maintaining the National Register of Sanctions and Compliance.

Any security incident that poses a risk to the rights of data subjects must be reported to the Personal Data Protection Agency. Although the law does not establish a specific number of hours or days for notification, it requires organisations to report breaches “through the most expeditious means possible and without undue delay.” This means companies must act as quickly as reasonably possible. Concealing or failing to report a breach is classified as a very serious infringement and may result in fines of up to 20,000 UTM.

The main obligations include:

• Compliant Cookie Banner: Use an opt-in model, ensure that non-essential cookies are disabled by default, and provide clear information about their purposes.
• Active Consent: Remove pre-ticked boxes and provide free and accessible mechanisms for withdrawing consent.
• Accessible Privacy Policy: Publish clear information regarding who processes personal data, for what purposes, for how long, with whom the data is shared, and how users can exercise their rights.
• Data Subject Rights Channels: Establish communication channels through which individuals can exercise their rights of access, rectification, erasure, objection, portability, and blocking, and respond within 30 calendar days, extendable by a further 30 days.
• Privacy by Design: Collect only the personal data strictly necessary for the intended purpose and implement safeguards such as encryption or pseudonymisation before processing begins.

Under Law No. 21,719, consent must satisfy four requirements: it must be freely given (without pressure or conditions), informed (the user must understand what data is collected, why it is collected, how long it will be retained, and whether it will be shared with third parties), specific (for a clearly defined purpose), and unambiguous (expressed through a clear affirmative action). Pre-ticked boxes and passive consent mechanisms are prohibited. Furthermore, individuals have the right to withdraw their consent at any time and without providing any justification. Businesses must therefore offer withdrawal mechanisms that are as simple as the methods used to obtain consent.

The law applies to any natural or legal person, whether public or private, that processes personal data in Chile. However, its scope extends beyond Chile’s borders. It also applies to foreign organisations when their activities are directed at offering goods or services to individuals located in Chile or when they monitor the behaviour of individuals within Chilean territory. This includes, for example, international digital platforms with Chilean users, foreign marketplaces selling to Chilean consumers, and applications that track user activity in Chile.