Chile redefines its privacy and cybersecurity framework with new compliance rules and upcoming regulatory changes

The second half of 2026 has been particularly eventful for Chile’s personal data protection and cybersecurity framework. Attention is focused on three developments: (i) the bill approved by the Chilean upper house, now moving to the lower house, pushes back the entry into force of Law No. 21,719 until October 15, 2027; (ii) publication of regulations on models for preventing infringements; and (iii) the preliminary text of the Chilean National Energy Commission’s (CNE) technical standard on cybersecurity for the electricity industry. The Chilean National Cybersecurity Agency (ANCI), for its part, issued a procedural adjustment concerning the classification of operators of vital importance and produced implementation initiatives that do not create new obligations.

Personal data protection

Bill proposing to push back the entry into force date of Law No. 21.719 in Chile

On October 28, 2026, the Chilean upper house approved, in the first constitutional reading, a bill amending Law No. 21,719 on the protection and processing of personal data and creating the Chilean Data Protection Agency (Bulletin No. 18,623-07), introduced by a presidential message dated August 31, 2026. After being designated for immediate consideration and reviewed by the Constitution and Finance committees, the bill will now be laid before the lower house for its second constitutional reading. Its main provisions, as approved by the upper house, are: 

• Postponement of entry into force of the law. The law would take effect on October 15, 2027, instead of December 1, 2026. The date originally recommended in the presidential message was December 1, 2026, the new date was added by the upper house's Committee on Constitution, Legislation, Justice, and Regulations, and the Finance Committee did not add any changes.
• Agency's executive board. The number of members is increased from three to five, serving six-year terms, without the option of re-election and with partial renewal every two years, and the quorum for conducting business is raised from two to three. 
• Appointment of the first board. This must take place by the end of nine months before the law enters into force (currently, six months). The Chilean president will propose, in a single act, the names of two members for six-year terms, two for four-year terms, and one for a two-year term. The upper house must vote on the recommendation as a whole, requiring the affirmative vote of two-thirds of its sitting members. Upon their appointment, the executive board members will be entitled to compensation and must serve on an exclusive basis. 
• Transitional provisions. The greater amount of fiscal expenditure in the first year will be financed out of the budget of the Chilean Ministry of Economy, Development, and Tourism, and any shortfall will be covered by the Chilean Public Treasury. If, upon publication of this law, there are fewer than twelve months remaining before Law No. 21,719 takes effect, the first appointment must be proposed to the upper house within the following ten days. The text approved by the upper house (a single article with three numbered points and two transitional provisions) does not provide for extension of the written warning regime to all data controllers. 

It is essential to make a clear distinction between what the upper house has approved and the law that is in effect. Until the bill completes its passage through the Chilean parliament and is published as law, Law No. 21,719 will come into effect on December 1, 2026, as stipulated in its first transitional article, and the Agency will keep the members established in the provisions in effect. Furthermore, the lower house may introduce amendments to the text. 

For companies, uncertainty over the effective date is not a reason for suspending compliance programs. With less than a month to go before the stipulated entry into force date, a prudent stance for companies would be to stick with the compliance schedule, giving preference to the inventory of processing activities, the determination of the legal bases for processing, the review of contracts with data processors, procedures for exercising rights, and the management of security breaches.

Regulations on models for the prevention of infringements

On September 9, 2026, the Chilean Official Gazette published Supreme Decree No. 662 of 2025, issued by the Chilean Finance Ministry, and approving the Regulations on the requirements, methods, and procedures for implementation, certification, registration, and oversight of the infringement prevention models referred to in article 49, which Law No. 21,719 incorporates into Law No. 19,628 (Supreme Decree No. 662 of 2025, issued by the Ministry of Finance, published in the Chilean Official Gazette on September 9, 2026).

The prevention model is voluntary: it may be adopted by any data controller, who may be a public or private individual or legal entity, and it consists of a compliance program. The regulations clarify that its adoption does not alter the general duty of every data controller to prevent infringements and comply with the law. The most notable elements of these regulations are:

• Minimum content of the program. It must include, among other elements, a characterization of the data and processing operations (purposes, legal bases, international transfers, retention periods, and automated decisions); a risk matrix identifying the processes with the highest infringement risk, taking into account the severity of penalties; specific prevention procedures; reporting mechanisms; internal penalties, and a reporting channel that ensures the confidentiality of the complainant’s identity.
• Labor and contractual integration. The internal regulations derived from the program must be expressly included as an obligation in employment and service contracts, including those of top executives, and, where applicable, in the internal rules and regulations governing order, hygiene, and safety.
• Data protection officer. The appointment of a data protection officer is mandatory as part of the program's adoption and certification process, although it is not a general requirement for every data controller. The officer must be appointed by the highest authority (such as the board of directors), be independent from management, possess specialized knowledge and sufficient resources, and must report directly to the person who appointed them. The officer may be internal or external, and a corporate group may appoint a single officer if it operates under common standards.
• Certification, registration, and oversight. Certification is initiated upon an application submitted by the data subject to the Chilean Agency, it is valid for three years and renewable, and results in registration on the Chilean National Register of Penalties and Compliance, which is publicly accessible. The Agency may oversee certified models, request information, and withdraw certification if, among other grounds, the data controller ceases to meet the requirements.

The main legal effect of the certification model is that it is considered a mitigating factor in relation to any penalties imposed by the Agency. Because the Agency is not yet up and running, the certification process is not yet in operation. However, the regulations allow implementation to begin before entry on the register.

Cybersecurity

Draft Technical Standard on Information Security and Industrial Cybersecurity for the Chilean electricity industry

The Chilean National Energy Commission (CNE) submitted the preliminary wording of the Technical Standard on Information Security and Industrial Cybersecurity for a public comment period between August 28 and October 2, 2026. This is a recommendation: its provisions are not enforceable and could be amended before its final adoption.

Scope of application and relationship to the Chilean Cybersecurity Framework Law. The law would apply to electricity companies, namely, coordinated entities in the Chilean national electricity system (generation companies, transmission companies, distribution companies, storage systems, eligible customers, and small distributed generation facilities (PMGDs), among others, medium-sized system operators, common control centers, and the Chilean National Electric Coordinator. In relation to information security, its requirements would be supplementary and applicable to companies that have not been classified as operators of vital importance (OIV) by ANCI; those classified as OIV would be governed also by Law No. 21,663 and its supplementary regulations. The requirements relating to industrial cybersecurity, however, would apply to all electric utilities and the coordinator. The Framework Law would take precedence in the event of any conflict, and oversight would fall to ANCI in coordination with the Chilean Electricity and Fuels Authority.

Information security. Non-OIV companies would be classified into high, medium, or low impact levels based on objective criteria (for example, more than 100,000 regulated customers for distributors). High-impact companies would be required to implement and certify an information security management system (ISMS) based on the ISO/IEC 27001 standard, with an applicability statement registered with the coordinator; medium- or low-impact companies would be required to implement 36 minimum controls drawn from the ISO/IEC 27001 and ISO/IEC 27002 standards. All companies would have to have an information security policy approved by senior management and an Information Security and Industrial Cybersecurity Unit, with a primary and a deputy officer, to act as the technical counterpart to the coordinator and the authorities.

Industrial cybersecurity. Companies should protect their operational technology environments in accordance with the cybersecurity standard for the electricity industry published by the coordinator in October 2022, based on the NERC-CIP standard. The requirements would depend on the impact level assigned to each network and information system based on the plant where it is located, such as control centers or power plants with a capacity of 300 MW or more. The implementation of complementary standards, such as ISA/IEC 62443 or ISO/IEC 27019, is permitted, and the coordinator would assess the maturity level annually, with the first measurement taking place in 2028.

Proposed time limits. Following publication, the first obligations would have time limits of between one and four months (designation of the Unit, security policy, and scope of the ISMS). The ISMS should be implemented within two years following the approval of the statement of applicability and certified within the following eight months, whereas the minimum controls would have time limits of three or four years depending on the level of impact. The cybersecurity standard would have to be implemented by operating companies within six months to one year, depending on the impact level of the network and information system.

For the industry, the bill confirms that determining OIV status will be key to identifying the applicable rules and that industrial cybersecurity requirements would also apply to OIVs. In view of the recommended time limits, it is advisable to conduct a gap analysis immediately.

Amendment to delegation of the authority to sign at the Chilean National Cybersecurity Agency (ANCI)

On October 9, 2026, ANCI’s Exempt Decision No. 250, dated October 7, 2026 was published, amending Exempt Decision No. 77 of 2025 on delegation of the authority to sign on behalf of the national director. Together with adjustments to purchases and personnel, it includes, among the delegated measures, decisions resolving administrative appeals lodged against measures issued in the OIV classification procedure. The decision does not change either the criteria or obligations applicable to OIVs, although it is relevant for entities challenging their classification, due to determining who signs the decision on their appeals.

Other implementation measures for the Chilean Cybersecurity Framework Law

As part of Cybersecurity Month, ANCI reported that in the first half of 2026 it received 324 reports of incidents with significant impact from essential service providers and OIVs and launched a reporting portal for citizens to report incidents and vulnerabilities, either giving their names or anonymously, using a safe harbor mechanism. This channel does not replace the legal notification obligations of regulated entities. The Agency also announced the first annual Chilean National Cybersecurity Drill, to be held on October 29, 2026, and included the ASPA (Autonomous System Provider Authorization) mechanism into the government’s secure connectivity network, making it more difficult for third parties to impersonate the network or divert its traffic to malicious sites. 

Principal implications for businesses

In relation to data protection, the statutory entry into force date for Law No. 21,719 is still December 1, 2026, and therefore, the recommended postponement should be treated as a contingency rather than an event to be planned for. Supreme Decree No. 662, already in effect, provides a concrete parameter for organizing internal governance, the risk matrix, and the role of data protection officer. In relation to cybersecurity, companies in the Chilean electricity industry should confirm their status regarding the OIV classification and carry out a preliminary assessment of the impact of the Chilean National Energy Commission’s draft standard. Entities subject to the Chilean Framework Law should, for their part, maintain their incident reporting procedures under current provisions.