Chile's data protection law postponed a year: what's lost?

The government filed, with top-priority urgency, a bill that pushes the data protection law back to December 2027. These are 16 consequences of postponing it again.

On Tuesday, September 1, the government filed a bill in the Senate, with top-priority urgency (suma urgencia), consisting of a single article and two transitional provisions. Its main effect fits in one line: Law 21.719 on personal data protection would take effect not on December 1, 2026, but on December 1, 2027.

The official rationale is reasonable as stated. The Executive says it seeks “institutional, regulatory and operational conditions” for proper implementation. Economy Minister Daniel Mas, who holds two portfolios, summed it up unambiguously: “We don’t want less protection of personal data.”

The problem isn’t the argument. It’s the fact that gives rise to it.

The law established that the Board of the Personal Data Protection Agency (APDP) had to be appointed six months before the law took effect. On May 19, 2026, the Senate rejected President José Antonio Kast’s shortlist for lack of quorum: 19 votes in favor out of the 33 needed. In June the deadline expired. The party with the obligation didn’t comply, and the way out it proposes is to move the date that obligated it.

The reform took about seven years to pass. It was published in the Official Gazette on December 13, 2024, with a two-year vacatio legis, precisely to prepare for this. These are 16 consequences of stretching it another year.

Timeline of Law 21.719 from its publication in December 2024 to the first possible fine in December 2028

The vacatio legis was 24 months. The extension plus universal optional warnings add another 24.

The State as the regulated party

1. It sets a precedent about who has to meet deadlines

The law gave the State a date before anyone else: the Board had to be constituted by June 1, 2026. That deadline was missed, and the legislative response wasn’t to meet it late; it was to replace it. When the regulator and the legislator are the same coalition, the date stops working as an obligation and starts working as a preference.

2. The extension redistributes advantages toward those who didn’t prepare

The Chilean Association of Personal Data Protection Professionals (AGPD) warned about it three weeks before the bill existed: the postponement can’t become a “lifeline” for companies or state bodies that didn’t make progress in time. The organizations that during 2025 and 2026 hired data protection officers, built their record of processing activities and ran impact assessments paid for a competitive advantage that is now diluted by administrative decision.

3. The first possible fine moves to December 2028

The bill removes the restriction that reserved written warnings (instead of fines) for smaller companies during the first year in force. With the change, any regulated controller will be eligible for one. Entry into force in December 2027 plus twelve months of universal optional warnings means the first effective financial penalty under the new law would come four years after its publication in the Official Gazette.

4. Positive silence lowers the standard of scrutiny for the body that’s supposed to be independent

The bill establishes that if the Senate doesn’t rule on the list of board members within the legal deadline, it’s deemed approved. It’s an efficient solution to a real bottleneck. It also makes non-deliberation the path of least resistance for appointing those who will oversee data processing across the whole country, in a process where an earlier shortlist was already withdrawn after the conflict-of-interest questions revealed by Interferencia in March.

5. The government’s own diagnosis isn’t corrected

In May, the Minister Secretary-General of the Presidency (Segpres), José García Ruminot, explained to the joint committees why he couldn’t find candidates: the APDP presidency pays the equivalent of 80% of an undersecretary’s salary, the directorships 70%, and the post requires exclusive dedication. “That has turned out to be a tremendous limitation,” he said. The bill raises the Board from three to five members and reinforces exclusivity from the moment of appointment. More posts to fill under the same restriction that made it impossible to fill three.

What still can’t be enforced

Table of the six rights under Law 21.719 that still have no administrative complaint route

The rights have been published since December 2024. The route to exercise them hasn’t.

6. Law 19.628 stays in force for twelve more months

The law still in force was written in 1999, before the smartphone, before the cloud and before the business model that consists of accumulating data existed. It provides for no supervisory authority. Its complaint route is judicial, slow and expensive, which is why almost nobody used it for twenty-five years.

7. ARSOP rights still have no administrative route

Access, rectification, erasure, objection and portability exist in the published text but not in practice: there’s nobody to complain to when a company doesn’t respond. One more year of rights that are written down and can’t be exercised.

8. The risk isn’t postponed along with the law

Leaks, ransomware and social engineering run on their own calendar. In 2021 the Electoral Service published on its own website a database with data on about 15 million people (national ID number, age, gender and Indigenous affiliation) at a time when there was no clear framework of responsibilities. There still isn’t one.

9. Data protection impact assessments stop being enforceable for another year

They’re mandatory when there’s large-scale processing of sensitive data, systematic monitoring, profiling or automated decisions with significant effects. In other words: exactly the kinds of processing that grew the most while the law was in its vacatio legis.

Comparison between the European Union and Chile of which algorithmic obligations remain in force after their respective postponements

Both blocs pushed their deadlines to December 2027. Only one left obligations standing in the meantime.

10. Article 8 bis is postponed, and with it the only Chilean rule with a date on automated decisions

Law 21.719 recognizes the data subject’s right to object to and not be subject to decisions based on automated processing, including profiling, that produce legal effects or significantly affect them. It also includes a right to an explanation of the logic applied, human intervention and challenge. None of that is an artificial intelligence law. But it’s the closest thing Chile has to one, and it operates on what is actually in production today: credit scoring (automated risk scores), recruitment filters, workplace biometrics, debt-collection segmentation.

11. Postponing it leaves the country without any algorithmic rule with a date

The bill regulating artificial intelligence systems (bulletins 16.821-19 and 15.869-19, merged) has been in its second constitutional reading in the Senate’s Future Challenges Committee since the Chamber of Deputies passed it on October 13, 2025. It has no date for a floor vote. Until Tuesday, 21.719 was the piece that did have one.

12. The coincidence with Europe is one of month and direction, not content

The European Digital Omnibus was published on July 24, 2026, and moved the Annex III high-risk obligations from August 2, 2026, to December 2, 2027. Chile proposes December 1, 2027. The difference lies in what each left standing: the European Union kept in force the transparency obligations of Article 50 and the AI literacy duty of Article 4. It postponed the heavy regime and kept the floor. Here the entire building would be postponed.

13. A year of deployment without traceability requirements

Automated systems installed between December 2026 and December 2027 will be installed with no requirement to document the decision logic, no challenge route and no demonstrable human review. Adding those layers later, on systems already integrated into business processes, costs more than designing them from the start. The extension reads as cost relief and works as the deferral of a bigger cost.

The cost that doesn’t appear in the bill’s message

14. International transfers still have no mechanism

The law gives the APDP the power to issue adequacy decisions, approve standard contractual clauses and validate binding corporate rules. Without a Board there’s no Agency, and without an Agency none of those instruments exist. Chilean companies that process data abroad will keep solving it contract by contract, which is exactly what the reform was meant to put in order.

15. Uncertainty isn’t eliminated; it’s doubled

The bill was filed with top-priority urgency, but it hasn’t been approved. Until the amendment is published, the date in force is still December 1, 2026. Every responsible organization has to maintain two plans in parallel while the bill moves through Congress: one that assumes the extension and one that doesn’t. Two scenarios cost more than one, and that cost is paid by the regulated party, not the legislator.

16. The pattern already has precedents, and the second extension always costs less than the first

In 2024, Congress passed an amendment to Law 21.368 to postpone the obligations on single-use plastics, after the regulation that was due in February 2023 didn’t arrive on time. The structure is identical: legislate with deadlines, don’t build the institutions, move the deadlines. Each repetition makes the next one cheaper.

There’s an early signal of where this additional year could lead. On the same day the bill was filed, the insurance industry publicly argued that the new law didn’t include the express authorization for processing data for statistical and pricing purposes that current legislation does provide, and that the postponement is the opportunity to revisit that issue. Postponing a calendar and reopening the substance are different things. They tend to come in through the same door.

Sources

By Rodrigo Cornejo, Founder of Mamífero.

This column expresses Mamífero’s editorial position and does not constitute legal advice. On how we work, see who writes.

One more year. The consequences of continuing to postpone technology legislation in Chile