Bill No. 18.060-07 was recently introduced in the Senate, proposing a series of amendments to Law No. 21.719 on Personal Data Protection, which was published last December and is scheduled to enter into force on December 1, 2026.
The bill acknowledges that certain aspects of the law, as approved, could give rise to significant practical difficulties, both in terms of its application and its impact on the digital economy and the day-to-day operations of organizations. In this context, the proposal seeks to correct elements that currently appear overly rigid or unrealistic.
The main proposed changes are as follows:
- Extraterritoriality and repeal of Article 1 bis
The bill proposes repealing Article 1 bis, eliminating both the closed list of scenarios for extraterritorial application and the rule subjecting foreign companies to Chilean jurisdiction solely because residents in Chile use their platforms. The main rationale is to avoid an inflexible framework that is ill-suited to technological evolution and difficult to implement in the context of global digital services.
- Narrowing the concept of sensitive personal data
The project amends the definition of sensitive data by removing broad or ambiguous categories—such as “physical or moral characteristics”—which could lead to common-use data being classified as sensitive. The proposal seeks to focus enhanced protection on information that genuinely reveals intimate or specially protected aspects of an individual, in line with comparative standards.
- Publicly accessible sources as a lawful basis
The bill seeks to expressly restore the possibility of processing data obtained from publicly accessible sources (for example, official registers or the Official Gazette) without requiring the data subject’s consent, provided that the processing is consistent with the original purpose of collection. According to the motion, the current regulation unnecessarily hinders the management of information that is already lawfully accessible.
- Elimination of the right to blocking as an autonomous right
The initiative proposes eliminating the so-called “right to blocking” as an independent right, retaining it solely as a precautionary measure within a complaint or claims procedure. The aim is to avoid inconsistencies with the general structure of rights and remedies under the Chilean legal system.
- Data controllers located abroad
The bill proposes eliminating the obligation for controllers without an establishment in Chile to appoint a legal representative and a physical domicile in the country. Instead, it would be sufficient to have an appropriate and operational means of contact (such as an email address) for both data subjects and the Data Protection Agency, aligning the requirement with the reality of delocalized services.
- Adjustments to the sanctioning regime
In light of fines that can currently reach up to 20,000 UTM, the project proposes new caps:
- up to 100 UTM for minor infringements;
- up to 1,000 UTM for serious infringements; and
- up to 5,000 UTM for very serious infringements.
The justification is to move toward a more proportional system, with an emphasis on prevention rather than sanctions that are difficult to enforce in practice.
- Incentives for compliance models
Finally, the proposal reinstates a more robust treatment of prevention and compliance models, establishing clear incentives for organizations that implement certified programs. These could operate as qualified mitigating factors or even allow for exemption from fines (except in cases of very serious infringements), reinforcing a preventive and public–private collaborative approach.
Si bien la ley entra en vigencia en diciembre de este año, esta discusión confirma algo importante: no basta con cumplir “en el papel”, sino que será clave diseñar estrategias de cumplimiento sólidas, realistas y defendibles frente a la autoridad.
Although the law is scheduled to enter into force in December of this year, this discussion confirms an important point: it will not be sufficient to comply “on paper.” Designing solid, realistic, and defensible compliance strategies vis-à-vis the authority will be key.
If you have any questions or require specific support regarding personal data protection matters, please contact Macarena Naranjo (mnaranjo@jdf.cl) or Consuelo Santana (csantana@jdf.cl)
