On this page
Who it is for
For companies in Chile that store people’s data and don’t have a security team of their own: a small business with a WordPress site (or another technology) that receives forms, a store with its customer database, a healthcare center with patient records, or a company that got a personal data protection questionnaire from a large client and doesn’t know how to answer it. Also if the system was built by a provider who’s no longer around and nobody can say for sure who accesses what.
If you’re looking for a data protection consultant to draft contracts or represent you before the authority, that’s a lawyer’s job.
The problem
Your company stores national ID numbers, emails, addresses, maybe client or patient records. They are spread across the website, spreadsheets and emails. If someone asks who can see them, the honest answer is “we are not sure”. Law 21.719 is Chile’s new personal data protection law and it changes that: it requires you to know what data you have, protect it properly and be able to prove it before an Agency that inspects and sanctions, with fines that a small business can’t treat as a cost of doing business. The date written in the law is December 1, 2026 and the Senate is processing a Government bill that would move it to December 1, 2027, with no votes yet. That doesn’t change the order of the work: knowing what you have and who accesses it comes first either way. If the date moves, you gain time to do it and the obligation stays the same.
And there’s a trap worth mentioning: most of what’s sold to “comply” is paperwork (a privacy policy, some documents, a manual). That’s needed, and the privacy policy template for Law 21.719 (in Spanish) gets that part written at no cost, but it isn’t what the law asks you to demonstrate. Meanwhile the real system stays the same: unencrypted data, open backups, half the team with administrator access, no record of who saw what, and indefinite retention just in case. Compliance done seriously is technical, and that’s the part almost nobody implements.
Technical consulting for Law 21.719
What the law is, when it takes effect and what it requires of a small business is in the full guide: Law 21.719, what it is and when it applies to your website (in Spanish). This page covers the other half: the technical implementation, with the controls working in your system on top of the legal text. I review how what you already have is built, put in place the controls that are missing and document the evidence.
What the law requires in your system
The law doesn’t come with a list of tools, but several of its obligations can only be met if something is running in the system. These are the ones that translate into technical work, and what I review in each one:
| What the law asks for | What it means in your system |
|---|---|
| Demonstrating compliance | After an incident it’s up to you to prove that the measures existed and were operating. Anything that wasn’t recorded with a date doesn’t work as proof |
| Security measures appropriate to the risk | Encryption or pseudonymization, role-based access, backups tested by restoring them and periodic verification |
| Consent | Free, informed, specific, prior, unambiguous and revocable through a means equivalent to the one you used to request it. There has to be a stored record of who accepted what and when |
| ARCOP rights | Access, rectification, erasure, objection and portability, plus temporary blocking. You have thirty calendar days to respond, extendable once, so you need to be able to find, export and delete a person’s data without going through spreadsheet after spreadsheet |
| Retention period | Telling people how long you keep each piece of data, and making sure deletion actually happens when the period ends |
| Processors (article 15 bis) | The hosting, the CRM, the bulk email tool and the plugins that process data on your behalf need a processing contract. On the technical side you need to know which provider touches which data and with which account |
| Security breaches | Reporting them to the Agency through the fastest available means and without undue delay. When the law requires it, the data subject is notified too. Without an access log there’s no way to know it happened or what was seen |
| Data protection impact assessment (DPIA) | High-risk processing is assessed before it starts. If you’re going to build something new with sensitive data, that gets resolved in the design |
The fines in article 35 come in tiers and are maximum amounts rather than set rates, and since the Agency isn’t operating yet there isn’t a single resolved case to use as a reference. The figures and the supposed grace year for small businesses are in the guide to the law (in Spanish).
What I do as a data protection consultant
Technical and operational focus (not legal):
- Role-based permissions instead of a master key (RBAC)
- Data subject rights: view, correct, delete (ARCOP)
- Cookie consent that works, without tricks
- Provider accounts reviewed, with the unneeded ones closed
- Sensitive data encrypted where it's stored
- Information encrypted in transit (TLS)
- Encrypted backups, with key rotation
- Map of what data you have and where
- Record of who accesses each piece of data (audit log)
- Technical documentation ready for auditors
- Breach notice: how it's detected and who reports it
- Automatic deletion of what should no longer be kept
- Retention period defined by type of data
- Risk assessment before building something new (DPIA)
What this looks like on the site itself (the banner that actually blocks, the form checkbox and the record that serves as proof of consent) is broken down in cookies, forms and consent under Law 21.719 (in Spanish), using the review I did of this site as the case.
What’s out of scope: formal legal advice is handled by a lawyer. I coordinate with the one you have or suggest who to go to. And securing the site where that data lives on the technical side (access, malware, backups) is WordPress security.
Breaches and providers
These are the two fronts I most often see unresolved in small companies, and in both of them what’s missing is technical before it’s documentary.
To report a breach in time, first you have to find out that it happened. That requires an access log that can be reviewed and a named person who decides when the Agency and the data subjects are notified. What I leave is that circuit set up and written down, so that on the day it happens you’re not reconstructing from memory who got in and what they saw.
Something similar happens with providers. The hosting, the CRM, the bulk email tool and every plugin process data on your behalf. Your lawyer handles the processing contract, but knowing which one touches which data, in which country it’s stored and with which accounts it gets in is technical work. I’ve come across administrator accounts of providers who left years ago and are still active, much more often than you would think.
The order I work in
If the deadline is close, this is the order I follow, because each step supports the next one:
- Data inventory: what you collect, which system each thing lives in and who accesses it.
- Access: role-based permissions and removal of the accounts that should not be there.
- Encrypted backups, tested by restoring them.
- Forms and cookies: a stated purpose, only the necessary data and a banner that blocks before the scripts load.
- Retention and providers: how long each thing is kept and who else touches it.
- Logs and evidence: recorded access, stored consents and dated documentation.
The privacy policy is best written at the end, when it can describe what the system actually does, and that’s what the template I mentioned above is for.
Real case
Active work: technical preparation of
Console CM VidaPlena for Law 21.719. It’s a system for a
medical center, so it processes health data, which the law classifies as sensitive. The work is in the
system itself: real role-based access control (beyond just admin and subscriber),
a record of who accesses sensitive data and encrypted backups, all three running in
production. Retention with automatic purging is in design. Before this, I worked on projects
with healthcare teams in the United States under HIPAA, always with a technical and operational focus,
not a legal one.
- roles
- 7
- permissions
- 19
How I do it
- 01
Diagnosis
I review what data you collect, where it lives, who accesses it and which providers touch it. You leave with the map and the 5 priority fixes.
- 02
Implementation
I put the controls in place in your system: role-based access, encryption, access logs, tested backups and recorded consent.
- 03
Evidence
I document what was done, with dates, so you can demonstrate compliance in an inspection by the Agency or to a client.
What you get
- The technical controls running in production, rather than a policy filed away in a drawer.
- The map of what data you have, where it lives and who accesses each piece.
- The list of providers that touch your data and what access each one has.
- The documentation and logs to demonstrate compliance.
- Which part needs a lawyer and why, if that applies.
What does a data protection consultant do?
It depends on the consultant. One with a legal profile reviews contracts, drafts policies and supports you before the authority. I do the technical side: I map what data you have, where it lives and who accesses it, I put in place the controls that Law 21.719 (Chile's personal data law) requires in the system (role-based access, encryption, access logs, backups, consent and retention) and I document what was done so you can prove it. When something needs a lawyer, I tell you which part and I coordinate with yours.
Do I need advice on Law 21.719 if I run a small business?
The law has no size threshold: if you have a contact form, analytics or a customer database, you're already responsible for personal data. It does provide that the information and security duties be met according to the size of the company, but those differentiated measures have to be set by the Agency (the data protection authority the law creates), and it hasn't done so yet. Hiring someone isn't mandatory, and with the guide to the law (in Spanish) and the privacy policy template (in Spanish) you can get a good part of the way on your own. Where small businesses usually struggle is the technical side (access, encryption, backups, logs), and that's what I review in the free diagnosis.
Does this replace a lawyer?
No. My work is the technical and operational side: how you store, protect and control access to data. Contracts, policies and anything that needs legal validity are handled by a lawyer. In the diagnosis I tell you which part needs one and why.
Do I need a data protection officer (DPO)?
Not as a general obligation. The law says the controller may appoint a personal data protection officer (article 50). It becomes mandatory if you adopt the voluntary infringement prevention model in article 49. I don't act as an outsourced DPO on a monthly retainer, but I do leave the technical side ready for that officer to review.
Do I have to do this now or can I wait?
The date written in the law is December 1, 2026. Since September 1, 2026 the Senate has been processing a Government bill that would move it to December 1, 2027, with no votes yet, and until it passes the original date applies. That doesn't change the order of the work: knowing what data you have and where it lives, and sorting out who accesses each piece, has to be done either way, and it's what later supports any policy or any proof you're asked for. If the date moves, you gain time to do it and the obligation stays the same.
What if a client or a tender asks me for proof that I comply?
That's exactly what the law calls demonstrating compliance: being able to show the record of your data, who accesses what and the technical measures you applied. I leave that evidence ready for you, and it's also what more and more B2B clients and tenders ask for before working with you.
How much does it cost for a small company?
It depends on what data you handle, where it lives and what state your system is in today. That's why the first step is the free 30-minute diagnosis: you leave with the map and the five priority fixes, and only then do we talk about scope, with no commitment.