Chile Law 19.628 + 21.719

Chile

25 domains

32 controls

Chile Law 19.628 (1999) as modernized by Law 21.719 (2024).

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (25)

Accountability

1 controls

Controls in the Accountability domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.28	Certification and Compliance Models (Art 26)	Controllers can demonstrate compliance through certification schemes and codes of conduct approved by the APDP. Certifie...

Automated Processing

1 controls

Controls in the Automated Processing domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.10	Right Regarding Automated Decisions (Art 8 bis)	Data subjects can object to decisions based solely on automated processing, including profiling, that produce legal or s...

Consent

1 controls

Controls in the Consent domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.02	Explicit Informed Consent (Art 12 lit a, Art 14)	Consent must be free, informed, specific, unequivocal and demonstrable. It must be obtained in writing or by equivalent...

Constitutional

1 controls

Controls in the Constitutional domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.30	Habeas Data Constitutional Action (Art 19 N.4 Constitution)	The Chilean Constitution recognizes protection of personal data as a fundamental right (since 2018 reform). Data subject...

Cross-Border

2 controls

Controls in the Cross-Border domain of Chile Law 19.628 + 21.719 — 2 controls
Code	Title	Description
CL.19628.18	International Data Transfers (Art 27 to 28 bis)	Transfers to countries providing adequate protection (EU and APDP-listed jurisdictions) are permitted. Other transfers r...
CL.19628.19	Adequacy Determinations (Art 28)	The APDP determines which third countries offer an adequate level of protection. The European Economic Area is recognize...

Data Quality

1 controls

Controls in the Data Quality domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.24	Data Quality and Accuracy (Art 9)	Personal data must be accurate, complete, current and relevant for the purposes of processing. Inaccurate data must be c...

Data Subject Rights

5 controls

Controls in the Data Subject Rights domain of Chile Law 19.628 + 21.719 — 5 controls
Code	Title	Description
CL.19628.05	Right of Access (Art 5 lit a)	Data subjects can request confirmation of whether their data is being processed and obtain a copy along with information...
CL.19628.06	Right of Rectification (Art 5 lit b, Art 12)	Data subjects can require correction of inaccurate, incomplete or outdated personal data. The controller must notify rec...
CL.19628.07	Right of Cancellation or Erasure (Art 5 lit c)	Data subjects can demand deletion when data is no longer necessary, consent is withdrawn, processing is unlawful, or the...
CL.19628.08	Right of Opposition (Art 5 lit d)	Data subjects can object to processing based on legitimate interest or public interest, including profiling and direct m...
CL.19628.09	Right of Portability (Art 5 lit e)	Data subjects can receive their personal data in a structured, commonly used and machine-readable format and transmit it...

Employment

1 controls

Controls in the Employment domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.29	Workplace Privacy (Art 19 sectoral)	Employer processing of employee data must respect proportionality, transparency and worker rights. Monitoring (email, vi...

Enforcement

1 controls

Controls in the Enforcement domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.26	Penalties and Sanctions (Art 34 quinquies)	Infringements are classified as minor, serious or very serious. Sanctions range from warnings up to 10,000 UTM (approxim...

Engineering

1 controls

Controls in the Engineering domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.13	Privacy by Design and Default (Art 14 bis)	Controllers must implement appropriate technical and organizational measures from the design stage and by default to ens...

Governance

2 controls

Controls in the Governance domain of Chile Law 19.628 + 21.719 — 2 controls
Code	Title	Description
CL.19628.11	Data Protection Officer (Art 49)	Controllers and processors must appoint a Data Protection Officer when core activities involve large-scale processing of...
CL.19628.12	Register of Processing Activities (Art 15 bis)	Controllers must maintain a written register of processing activities including controller identity, purposes, data cate...

Incident Response

1 controls

Controls in the Incident Response domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.16	Breach Notification 72 Hours (Art 14 quinquies)	Controllers must notify the APDP of personal data breaches within 72 hours of becoming aware. Where the breach is likely...

Lawful Basis

1 controls

Controls in the Lawful Basis domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.01	Lawful Basis for Processing (Art 12 Law 21.719)	Processing of personal data must rely on one of six lawful bases: consent of the data subject, contract performance, leg...

Marketing

1 controls

Controls in the Marketing domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.22	Direct Marketing (Art 4 quinquies)	Direct marketing requires a lawful basis, either consent or legitimate interest with a meaningful opt-out. Every marketi...

Minors

1 controls

Controls in the Minors domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.04	Children Data (Art 16 ter)	Processing personal data of children under 14 requires consent from parents or legal guardians. Adolescents 14 to 18 can...

Regulator Engagement

1 controls

Controls in the Regulator Engagement domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.27	APDP Inspection and Cooperation (Art 30)	The Personal Data Protection Agency has powers to investigate, request information, conduct on-site inspections, issue b...

Retention

1 controls

Controls in the Retention domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.25	Retention and Storage Limitation (Art 13)	Personal data must be kept for no longer than necessary for the purposes of processing. Once the purpose is achieved or...

Risk Assessment

1 controls

Controls in the Risk Assessment domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.14	Data Protection Impact Assessment (Art 15 ter)	DPIA is mandatory for processing likely to result in high risk to rights and freedoms, including large-scale sensitive d...

Sectoral

2 controls

Controls in the Sectoral domain of Chile Law 19.628 + 21.719 — 2 controls
Code	Title	Description
CL.19628.20	Public Sector Processing (Title V)	Public bodies process personal data under legal authority for public interest tasks. They must publish processing activi...
CL.19628.21	Credit and Financial Data (Art 17 to 18)	Processing of commercial and economic obligation data (DICOM and similar) is regulated separately. Negative credit data...

Security

1 controls

Controls in the Security domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.15	Security of Processing (Art 14 quater)	Controllers and processors must implement appropriate technical and organizational measures to ensure a level of securit...

Special Categories

1 controls

Controls in the Special Categories domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.03	Sensitive Data Categories (Art 2 lit g, Art 16)	Sensitive data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, union membershi...

Third Parties

1 controls

Controls in the Third Parties domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.17	Processor Obligations and Contracts (Art 15)	Processors act only on documented instructions of the controller. A binding contract must set out subject matter, durati...

Training

1 controls

Controls in the Training domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.32	Training and Awareness (implicit Art 14 quater)	Controllers and processors must ensure personnel processing personal data are trained on obligations, security measures,...

Transition

1 controls

Controls in the Transition domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.31	Transition Period and Readiness (Law 21.719 Transitorias)	Law 21.719 enters into force 24 months after publication (December 2026). During the transition controllers must adapt p...

Transparency

1 controls

Controls in the Transparency domain of Chile Law 19.628 + 21.719 — 1 controls
Code	Title	Description
CL.19628.23	Transparency and Privacy Notice (Art 14)	Controllers must provide clear, concise and accessible information at the time of collection including identity, purpose...

Frequently Asked Questions

What is Chile Law 19.628 + 21.719?

Chile Law 19.628 + 21.719 is a compliance framework from Chile with 25 domains and 32 controls. Chile Law 19.628 (1999) as modernized by Law 21.719 (2024). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Chile Law 19.628 + 21.719 have?

Chile Law 19.628 + 21.719 has 32 controls organised across 25 domains. The largest domains are Data Subject Rights (5 controls), Cross-Border (2 controls), Governance (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Chile Law 19.628 + 21.719 map to?

Chile Law 19.628 + 21.719 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Chile Law 19.628 + 21.719 compliance?

Start your Chile Law 19.628 + 21.719 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Chile Law 19.628 + 21.719 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 32 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.

Get Started Free →

Free forever — no credit card required