Prepare your eCommerce: Chile personal data law 2026

Chile operated for years under a framework that left most violations without an effective response, while public concern about the use of personal data was growing. The problem is no longer legal. It is strategic. That public concern and the lack of trust are part of the context that drove the regulatory change in Chile (gerencia.cl on data protection in Chile).

This is enhanced with a good digital marketing service.

For any company that depends on digital acquisition, remarketing, automation, analytics, personalization, or AI, Chile's personal data law stops being a topic for the legal department and becomes a board-level decision. Data is no longer just a commercial asset. Now it is also a material source of operational, financial, and reputational risk.

The central point is simple. Many companies still treat privacy as a footer document, a task for the web provider, or a policy that is updated "later." That logic is already outdated. From 2026 onward, the difference between growing with data and exposing yourself with data will depend on internal governance, digital architecture, and executive discipline.

The New Digital Scenario in Chile from 2026 Onward

Chile went from having a pioneering but aging law to a much more demanding framework. Law 21.719, published on December 13, 2024 and in force from December 1, 2026, changes how companies must capture, use, share, and safeguard personal information. It is not a minor update. It is a redesign of the operating standard for any digital business.

For the C-suite, the relevant change is not in the legal terminology. It is in three concrete impacts.

Privacy enters the executive committee

First, data management stops being a matter spread across marketing, IT, and external providers without a real owner. The new law demands traceability, clear legitimacy criteria, breach notification, and the ability to respond to data-subject requests. That forces you to define internal owners, decision processes, and controls.

Second, the law aligns Chile with stricter international standards. That matters if your company operates with global tools, sells outside the country, contracts international SaaS, or shares data with parent companies, partners, or agencies abroad. The Chilean digital business is integrating into an environment where improvisation no longer scales.

Risk and opportunity coexist

Companies that keep operating with ambiguous forms, legacy databases, poorly managed cookies, or opaque integrations will carry unnecessary exposure. In contrast, those that organize their data flows will have a clear competitive advantage: better data quality, less reputational friction, and a more solid foundation to automate without fear.

The new law does not punish the use of data. It punishes disorderly, opaque, and hard-to-justify use.

That changes the conversation. It is no longer enough to ask "what can we do with the data." The right question is "what can we sustain before customers, agency, provider, audit, and authority."

From Paper to Practice: The Big Leap from Law 19.628 to 21.719

The distance between 1999 and 2026 is not legal. It is operational. In that period, companies went from simple databases to ecosystems with CRM, automation, pixels, marketplaces, CDP, cloud providers, and AI models. The old law was designed for a different kind of business.

Law 19.628, published in 1999, was outpaced by the real way data circulates today in the digital economy. The text of the new law and its legislative process reflect that change of standard, as can be reviewed in the Library of the National Congress on Law 21.719.

From a declarative law to a law that demands execution

The central point for senior leadership is simple. Before, many companies could live with disorderly practices because the cost of not fixing them was low and the supervisory pressure was limited. That cycle is ending.

Law 21.719 establishes a specialized authority, expands control powers, and turns data management into a matter of operational discipline. That changes concrete decisions. How leads are captured. How analytics is configured. Which providers can receive data. What is documented. What gets turned off.

The real leap is in the ability to demonstrate control

FactorLaw 19.628Law 21.719SupervisionWeak and reactive schemeSpecialized enforcement with control capacityEconomic riskLimited and dispersed exposureHigher fines and tougher criteria for serious violationsOperational requirementLess pressure to documentNeed for traceability, response, and internal governanceDigital impactLow focus on complex ecosystemsReal scope over eCommerce, marketing, and automation

That forces leaving behind a common mistake. Treating privacy as a policy published in the footer.

In 2026, the useful question will not be whether your company has documents. It will be whether it can prove which data comes in, what it is used for, which tool it ends up in, which provider processes it, how long it stays active, and which automated decisions rely on it.

What changes for eCommerce, CRO, and marketing

The change hits the digital commercial operation directly.

If your team runs campaigns with custom audiences, uses conversion events, integrates forms with the CRM, syncs data with Meta or Google, applies lead scoring, or tests AI tools for support and content, it is no longer enough for it to "work." It has to be defensible.

That requires reviewing four fronts:

• Acquisition. Forms, popups, checkouts, and landings must separate purposes instead of mixing everything into a single authorization.
• Measurement. Pixels, tags, cookies, and events must respond to a clear logic of collection and use.
• Automation. Nurturing flows, profile enrichment, and scoring require rules the business can explain.
• Providers. SaaS, agencies, clouds, chatbots, and AI engines become part of the risk map, not just the stack.

To ground that change in the daily operation, it is worth reviewing this guide on data protection in digital environments.

Executive recommendation

Do not treat this transition as a low-impact legal adjustment. Treat it as a redesign of your data operations.

Companies that reach 2026 with a data inventory, usage criteria, aligned contracts, documented flows, and control over international transfers will reduce commercial and reputational friction. Those that keep depending on ambiguous forms, opaque integrations, and AI tools connected without criteria will expose revenue, brand, and growth capacity.

Main Obligations for Digital Companies

Most companies do not need more theory. They need to understand what changes in the daily operation. The short answer is uncomfortable: quite a lot changes.

The law requires the company to be able to explain why it collects data, what it does with it, who has access, how long it keeps it, on what basis it processes it, and how it responds if something goes wrong. That affects marketing, sales, product, support, and technology.

Consent and legitimate basis are not a formality

The classic mistake is to assume that any checkbox works. It does not.

If a lead leaves their email on a landing page to download content, the company has to distinguish whether that data will be used only to deliver the resource, to nurture them by email, to segment them for advertising, or to enrich their commercial profile. Mixing all those purposes into a blurry consent is a bad idea.

In practice, that forces you to review:

• Acquisition forms. Each relevant use must be clearly communicated.
• Privacy policies. They must talk to the reality of the digital stack, not a generic template.
• Tagging and measurement. If the site fires events, pixels, or integrations, that collection must be aligned with what was disclosed to the user.

On teams working with advanced analytics, it is worth reviewing how tags, triggers, and variables are implemented. A useful starting point is this perspective on Google Tag Manager and its role in digital measurement.

Security and incident response

The obligation most underestimated by eCommerce and high-traffic sites is breach notification. Article 14 sexies requires the controller to report to the Agency, by the quickest means possible and without undue delay, any breach that causes the destruction, leakage, loss, or alteration of personal data, or unauthorized access to it, when there is a reasonable risk to the rights and freedoms of data subjects. The law does not set a deadline in days.

The same article requires keeping a record of those communications, describing the nature of the breach, its effects, the categories of data, the approximate number of affected data subjects, and the measures adopted. And when the breach affects sensitive data, data of children under fourteen, or economic, financial, banking, or commercial data, each affected data subject must also be notified in clear and simple language; if that is not possible, through a notice in a mass media outlet with national reach (Law No. 21.719, art. 14 sexies, accessed at bcn.cl/leychile on September 1, 2026).

That requirement changes operational discipline. It is no longer enough to "investigate first." You have to be able to detect, escalate, assess, and decide quickly.

What any digital company must have

• Inventory of systems. Know where the data is. CRM, ERP, Shopify, WooCommerce, Meta Ads, Google Analytics, HubSpot, Mailchimp, forms, and backups.
• Incident protocol. Who detects, who assesses, who communicates, and who documents.
• Controlled access. Fewer users with excessive privileges. More traceability.
• Retention criteria. Do not accumulate data just because.

A mature digital business does not just protect its data. It knows exactly where it is and who touches it.

Operational transparency

The law also pushes you to abandon two very common bad practices.

The first is hiding complex decisions behind endless texts no one understands. The second is depending entirely on third parties to explain how data circulates. If your team cannot clearly describe what happens from the moment someone enters the site until they receive a campaign or an automated message, you are operating blind.

The new standard rewards companies that document and punishes those that improvise.

What Does Law 21.719 Require You to Publish on a Company's Website?

Article 14 ter requires keeping twelve pieces of information permanently available to the public on the website or an equivalent medium. It is not a recommendation: it is a duty, and total or partial failure to comply is classified as a minor infraction in article 34 bis.

This is what must be published:

1. The personal data processing policy, with its date and version. Having a policy is not enough: you have to state when it is from.
2. Who the data controller and its legal representative are, and who the prevention officer (encargado de prevención) is, if one exists.
3. A contact channel for data-subject requests: postal address, email, form, or an equivalent, easily accessible means.
4. What data is processed and why. The categories of data, a general description of whose data it is, to whom it is communicated or transferred, the purposes of each processing activity, and the legal basis for each. If the basis is legitimate interest, you must say what that interest is.
5. The security measures adopted to protect the databases.
6. The data subject's right to access, rectify, delete, object to, and port their data.
7. The right to file a claim with the Agency if the controller rejects the request or does not respond on time.
8. International transfers, if any, and whether the destination country or organization offers an adequate level of protection. If it does not, what safeguards justify the transfer.
9. How long the data is kept.
10. Where the data comes from and whether it comes from publicly accessible sources.
11. When processing is based on consent, the right to withdraw it at any time, making clear that withdrawing it does not affect the lawfulness of processing carried out before.
12. The existence of automated decisions, including profiling, with meaningful information about the logic applied and the expected consequences for the data subject.

Point 12 is the one most companies will overlook. It applies to anyone using algorithmic segmentation, scoring, or automated models on people's data, and it requires explaining the logic in terms the data subject can understand.

Article 14 septies qualifies the standard: the minimum requirements are determined by considering the type of data, whether the controller is a natural person or a legal entity, and the size of the company. An SME and a bank do not face the same bar, but both must cover all twelve points.

Covering these twelve points does not make a company compliant with Law 21.719: it is the duty to inform under article 14 ter and nothing more. The consent rules of article 12, the data-subject rights of articles 5 to 9, the security measures of article 14 quinquies, the breach reporting of article 14 sexies, the impact assessment of article 15 ter, and the international transfers of articles 27 to 29 remain outside it.

Source: Law No. 21.719, article 14 ter, accessed at bcn.cl/leychile on September 1, 2026.

New Rights and Their Impact on Marketing Strategies

Marketing has always wanted more data, more signals, and more automation. The new law forces it to want something additional: more internal control.

Data-subject rights are not a legal appendix. They are a real restriction on how to design experiences, campaigns, and personalization models. When a person can access, rectify, cancel, object, port their data, or challenge automated decisions, marketing stops operating in a one-way mode.

Personalization yes. Opacity no

Many brands personalize banners, offers, recommendations, popups, and email sequences based on prior behavior. That can continue, but with one condition: the company must be able to sustain that logic when the user objects or asks to limit the processing.

If the growth team uses automatic rules to change CTAs, prioritize leads, or segment traffic by behavior, the question is no longer just whether it works. The question is whether the process can be explained and whether there is a reasonable way to exclude anyone who does not want to be part of that logic.

Portability and frictionless exit

The right to portability changes another assumption of the digital business. Historically, many companies have treated accumulated data as a retention advantage. The new perspective forces you to assume that the user may want to move their information to another provider or use it in another way.

That hits:

• Loyalty programs
• Purchase histories
• Platforms with user accounts
• Services that build profiles or preferences

A company that complicates the exit of data is taking an unnecessary risk.

ARCO can no longer live in improvised support

Access, rectification, cancellation, and objection require clear processes. It is not enough to handle these requests as an exception, by email, without uniform criteria, and depending on who is available.

Where marketing usually fails

RightFrequent risk in marketingAccessNot knowing which exact data is spread across the CRM, the email platform, and advertising toolsRectificationCorrecting in one system but leaving the old data active in anotherCancellationRemoving from the newsletter but not from audiences or automationsObjectionContinuing to profile or personalize despite the data subject's objectionPortabilityNot having a clear format to deliver useful informationAutomated decisionsUsing scoring or segmentation without basic explanation capability

Practical rule: if marketing cannot pause, modify, or exclude a person at all the relevant points of the stack, compliance is incomplete.

The most important thing is not to "limit" marketing. It is to force it to mature. Truly solid strategies do not depend on capturing everything. They depend on making better use of what can be justified.

The Real Financial Risk of Non-Compliance

The conversation changes when it lands on numbers. Not for drama, but for business discipline.

Law 21.719 establishes a sanctions scheme that no serious board should treat as a marginal risk. Article 35 sets fines of up to 5,000 UTM for minor infractions (which also allow a written warning), up to 10,000 UTM for serious ones, and up to 20,000 UTM for very serious ones. If the controller does not adopt, within sixty days, the measures ordered by the Agency, a 50% surcharge on the fine applies, and in cases of repeat offenses a fine of up to three times the amount of the infraction may be applied.

The percentage of revenue (2% for serious infractions and 4% for very serious ones) applies only to companies that are not smaller-sized enterprises under Law No. 20.416 and that also reoffend, and it is calculated on annual revenue from sales and services and other activities of the business line in the last calendar year. Not on the global revenue of a group. A large company that commits a very serious infraction for the first time falls in the 20,000 UTM bracket, not the 4% (Law No. 21.719, art. 35, accessed at bcn.cl/leychile on September 1, 2026).

Sanctions Regime · Law 21.719, Article 35

• Minor infraction: written warning or a fine of up to 5,000 UTM.
• Serious infraction: fine of up to 10,000 UTM.
• Very serious infraction: fine of up to 20,000 UTM.
• Surcharge for failing to remedy: an additional 50% if the measures ordered by the Agency are not adopted within sixty days.
• Repeat offense: up to three times the amount of the infraction committed.
• Percentage of revenue: 2% for serious infractions and 4% for very serious ones, only for companies that are not smaller-sized enterprises under Law No. 20.416 and that also reoffend, calculated on annual revenue from the business line in the last calendar year.

The figures are expressed in UTM because that is how the law sets them. The UTM is adjusted every month, so any conversion to pesos or dollars only makes sense when accompanied by the date of the value used.

The mistake of seeing compliance as a sunk cost

Many companies approve budgets without discussion for traffic acquisition, martech, redesign, or commercial expansion, but delay investment in data governance because "it does not produce direct revenue." That reasoning no longer holds.

Non-compliance does not just expose you to sanctions. It also makes operations more expensive, forces crisis responses, erodes trust, and complicates relationships with international partners. When a company cannot justify its data processing, it also cannot scale with peace of mind.

Accountability in business language

The legal word is accountability. In executive language, it means something else: the company must be able to prove that it controls its data system.

That requires evidence. Policies aligned with real practice. A record of decisions. Defined owners. Reviewed contracts. Incident protocols. Consistent responses to data-subject requests.

Compliance without documentary proof is not compliance. It is a declaration of good intentions.

The rational decision is not to wait for an audit or an incident to arrive. It is to reduce now an exposure that already exists.

Compliance Checklist for eCommerce and Marketing

Most companies do not need to start with a large corporate program. They need to start with a serious review of their digital operation. The best approach is to treat the adaptation as a cross-cutting audit of the business, not as an isolated task for the legal area.

The most revealing data lies in the current market gap. 68% of eCommerce businesses in Chile use data-based personalization, but only 22% have privacy policies updated for the new law, according to this analysis on the personal data protection law in Chile. In other words, many companies already operate with commercial sophistication but with weak governance.

Website and acquisition assets

The site can no longer be seen only as a storefront. It is a data collection system.

• Review forms and capture points. Contact, quote, newsletter, lead magnet, scheduling, support. Each one must have a clear purpose consistent with what is communicated.
• Evaluate the consent banner. If it exists, it must reflect a real user decision and not an automatic acceptance in disguise.
• Align the privacy policy with the real tools. If you use Google Analytics, Meta Pixel, CRM, online chat, or third-party integrations, the text must reflect that reality.
• Map scripts and tags. Many companies have legacy tags, duplicate events, or pixels no one manages. That is a risk debt.

Warning signs on the site

SignalWhat it revealsGeneric policy downloaded from the internetLack of control over the real processingForms with no explanation of subsequent useRisk of insufficient consentMultiple scripts added by different agenciesLack of technical governanceCookies without clear managementMisalignment between acquisition and transparency

eCommerce and transactional operation

In e-commerce, the problem is not just capturing data. It is that the business depends on it to sell, ship, serve, and build loyalty.

You have to review checkout, user accounts, cart recovery, points programs, logistics integrations, payment gateways, antifraud systems, and after-sales service tools. Each layer adds complexity.

Executive checklist for eCommerce

1. Identify which data is necessary to sell and which you are asking for out of habit. If you ask for more than necessary, you increase exposure without gaining real value.
2. Review how you disclose secondary uses. A purchase does not automatically mean accepting expanded commercial profiling.
3. Validate internal access. Support, operations, marketing, and the agency should not see more than they need.
4. Examine third-party integrations. Shopify apps, plugins, connectors, and attached platforms often open low-visibility data flows.
5. Organize retention criteria. Not every historical database needs to stay active indefinitely.

A healthy eCommerce is not the one that accumulates the most data. It is the one that best distinguishes between useful data, sensitive data, and unnecessary data.

Marketing, automation, and audiences

This is the most delicate part because almost all modern digital growth depends on some level of tracking, segmentation, or personalization.

Marketing teams should audit, at minimum:

• Lead databases. Source, date, declared purpose, and consent traceability.
• Email automations. Welcome, nurturing, remarketing, win-back, and transactional flows.
• Advertising audiences. List uploads, lookalikes, exclusions, and platform syncs.
• Scoring and profiling systems. Especially if they affect commercial treatment or lead prioritization.
• Tests and experiments. If they use individual behavior to adjust experiences, they must be within the disclosed framework.

Questions the team must be able to answer

• Can we demonstrate when and for what purpose a piece of data was obtained?
• Do we know on which platforms each segment lives today?
• Can we stop a processing activity if a person objects?
• Do we have a single, consistent version of the current policy?
• Is there a criterion for deleting or anonymizing information?

Minimum governance to start well

You do not need to turn the adaptation into unmanageable bureaucracy. But you do need to establish a serious base.

Priorities for the next steps

• Appoint an internal owner. Even if the final model evolves, someone must coordinate.
• Build a data map. Without a map, any plan will be superficial.
• Define a remediation path. What gets fixed first, what gets documented, what gets replaced.
• Involve leadership. If the topic stays only in operational hands, it will lose priority.
• Review critical providers. Where there is data, there is contractual dependency and shared risk.

Companies that start now will reach 2026 with control. Those that wait will have to adapt sites, campaigns, contracts, and processes all at the same time. That scenario always ends up more expensive.

International Data Transfers and the Future with AI

Most guides on Chile's personal data law stop at consents, policies, and breaches. That is insufficient. The most complex points are elsewhere: international transfers and AI applied to marketing.

If your company uses Google Analytics, cloud platforms, foreign CRMs, support tools, automation SaaS, or AI models to classify leads and analyze behavior, you are already touching these two fronts.

The mistake of believing that "using global SaaS" is neutral

It is not. Every time personal data leaves the local perimeter or becomes accessible to an international provider, the company needs to understand under what conditions that transfer operates and what guarantees support it.

The usual problem is not bad faith. It is executive ignorance. Many companies buy technology for functionality, price, or speed of implementation, but never review implications of privacy, contract, jurisdiction, or subprocessors.

That creates an unnecessary fragility, especially in companies with binational or regional operations.

AI in marketing without evaluation is a risky bet

AI adoption in eCommerce in Chile rose 37% in the last year, but most companies do not carry out Data Protection Impact Assessments for large-scale processing such as user profiling or systematic monitoring, according to this analysis on Chile's privacy law and its impact on AI.

That data matters because many "marketing" decisions are, in reality, automated decisions about people. Which lead gets prioritized. Which offer a user sees. Which segment receives a sequence. Which traffic is considered most valuable. Which pattern triggers a commercial action.

Questions the board should already be asking

• Which tools use personal data to train, suggest, or classify?
• Which international providers participate in that flow?
• Which contracts cover transfer, security, and subsequent use of the information?
• When is an impact assessment appropriate?
• Can we explain an automated logic if a customer challenges it?

For teams that make decisions from dashboards, attribution, and consolidated reporting, it is also worth reviewing how data is centralized and who controls access. This perspective on Looker Studio Pro and its use in more demanding reporting environments helps think about that layer with more judgment.

AI does not eliminate responsibility. It concentrates it. If an algorithm influences a commercial decision, the responsibility still belongs to the company.

What changes in practice

The company that wants to keep innovating with AI and global tools will have to professionalize two things. First, contractual and provider review. Second, the ability to justify why certain automated processing activities are proportionate, necessary, and governable.

The future will not be less data-intensive. It will be more demanding about the quality of its management.

Beyond Compliance: A Strategic Opportunity

Companies that read this law only as a threat will react late and badly. They will do the minimum, under pressure, focused on putting out fires. That rarely produces a good digital operation.

The right reading is another. The law forces you to organize something that was already disorganized. And that order generates value.

A company that maps its data well understands its operation better. A company that asks for less unnecessary information improves friction. A company that documents criteria cleans up its stack. A company that reviews providers reduces blind dependency. A company that manages consent with clarity builds trust.

That is the most underrated point. Well-managed privacy does not slow growth. It makes it more sustainable.

In the coming months, the smartest teams will not be the ones discussing how to "dodge" Chile's personal data law. They will be the ones using it to improve governance, data quality, customer relationships, and the ability to scale with fewer vulnerabilities.

The right agenda for the C-suite is concrete:

• Treat data as a business matter
• Put marketing, technology, and leadership at the same table
• Review tools, contracts, and flows
• Build a defensible operation before December 2026

Complying will be mandatory. Turning that effort into a competitive advantage will be a management decision.

If your company needs to turn this regulatory requirement into a clear roadmap for its digital operation, Bigbuda can help you organize sites, eCommerce, analytics, automation, and growth processes with a strategic perspective oriented toward performance, governance, and scalability.

Related reading: E-commerce: Master Data Protection Law in 2026

Frequently asked questions

When does Chile's new personal data law take effect?

Law 21.719 was published on December 13, 2024 and is in force from December 1, 2026. It is not a minor update to Law 19.628: it redesigns how companies must capture, use, share and safeguard personal information, adding a specialized authority with real control powers.

What are the fines for non-compliance?

Fines can reach up to 5,000 UTM for minor infractions, 10,000 UTM for serious ones and 20,000 UTM for very serious ones. The percentage of revenue (2% for serious and 4% for very serious infractions) applies only to companies that are not smaller-sized enterprises under Law No. 20.416 and that also reoffend, and it is calculated on the last calendar year's annual revenue from the business line, not on a group's global sales.

How quickly must a data breach be reported?

The law does not set a deadline in days. Article 14 sexies requires the controller to report to the Agency, by the quickest means possible and without undue delay, any breach that causes the destruction, leakage, loss, or alteration of personal data, or unauthorized access to it, when there is a reasonable risk to the rights and freedoms of data subjects. When the breach affects sensitive data, data of children under fourteen, or economic, financial, banking, or commercial data, each affected data subject must also be notified. Breach notification is the obligation most underestimated by eCommerce and high-traffic sites.

Can I keep personalizing campaigns and audiences?

Yes, but with one condition: the company must be able to sustain that logic when a user objects or asks to limit the processing. If the growth team uses automatic rules to change CTAs, prioritize leads or segment traffic by behavior, consent and legitimate basis can no longer be a formality.

What should my eCommerce audit first?

Treat it as a cross-cutting audit, not a legal task. Review forms and capture points, the consent banner and the privacy policy on the acquisition side. Then checkout, user accounts, cart recovery, points programs, logistics integrations, payment gateways, antifraud systems and after-sales tools, plus lead databases, automations and advertising audiences.

Does using global SaaS or AI tools create extra obligations?

Yes. Every time personal data leaves the local perimeter or becomes accessible to an international provider, you need to understand under what conditions that transfer operates and what guarantees support it. AI adoption in eCommerce in Chile rose 37% in the last year, yet most companies skip Data Protection Impact Assessments.