Law 21.719: Data protection by design
By Mauricio Moreno
The new Law No. 21.719, which regulates the protection and processing of personal data, will enter into force on December 1, 2026, and will modify the way companies must manage them. For years, many organizations have acted after the problem has already occurred: they correct a misdirected email, change passwords after a leak, or review their contracts upon receiving a complaint.
The main innovation of the law consists of so-called «data protection by design,» which shifts the focus from a reactive perspective to a preventive one. Below, I propose three essential questions for companies to prepare for these new challenges:
What data do I handle and how do I process them?
To adopt protection by design, companies must have a complete overview of their personal data processing operations. This requires identifying what data they collect, for what purpose they store it, where it is kept, and who has access to it. From that map, it is possible to build a solid and defensible data structure.
What challenges does company size pose?
All companies must comply with the new law; however, its requirements pose distinct challenges depending on their size. For example, an SME can start by appointing an internal officer, preparing a simple inventory, delimiting access permissions, setting deletion deadlines, and establishing a procedure to respond to incidents. A large enterprise, on the other hand, will have to coordinate subsidiaries, legacy systems, and large-scale vendors.
Smaller companies will have a transitional rule during the first 12 months of validity: when a sanction corresponds, the Agency may choose a written reprimand. This does not constitute immunity against fines, since the norm uses the verb «may» and, furthermore, the reprimand will be recorded. Therefore, this flexibility must be understood as an opportunity to adapt, not as authorization to postpone compliance.
What does comparative experience teach us?
Chile is joining the international trend of modernizing data protection laws. Comparative experience offers valuable lessons on the measures that allow companies to face these challenges with better results.
Thus, for example, in January 2026 the French data protection authority imposed fines totaling 42 million euros on two telecommunications operators after an attacker accessed data associated with 24 million contracts. The investigation detected deficiencies in the security architecture of both companies, including insufficient remote authentication, ineffective controls against anomalous behavior, and the unjustified retention of former customers’ data.
On the other hand, there are cases where security measures, cooperation with the authority, and timely reaction make it possible to significantly mitigate the consequences of a breach. In 2019, the British authority proposed a £99.2 million fine against Marriott for a security breach that exposed 339 million records. The sanction ultimately remained at £18.4 million, after considering, among other factors, the investments made in security, the company’s cooperation with the investigation, and the measures adopted to mitigate the effects of the incident.
The challenge consists of moving from declarative protection to effective control. The best-prepared companies will not necessarily be those with the largest budget, but those capable of responding and demonstrating what data they process, for what purpose, where they keep it, who has access to it, and with whom they share it. Taking data protection seriously begins before the first incident.
Mauricio Moreno
Attorney-at-law