Chile's government asked the Senate on September 1, 2026 to push back by a full year the start of Law 21.719, the country's new personal data protection statute, and to expand the board of the regulator it creates from three members to five. The presidential message, numbered 110-374, dated August 31 and signed by President José Antonio Kast and three ministers, entered the Senate as Bulletin 18.623-07. On October 26, the Senate's Constitution Committee approved the bill article by article but changed the central date: the law would take effect on October 15, 2027, not on December 1, 2027 as the executive proposed. Until a new law is published in the Diario Oficial, the legal start date remains December 1, 2026.

In Short

Chile passed a strong privacy law in 2024 that is due to start on December 1, 2026, but the people who are supposed to run its new privacy regulator have still not been appointed. The president asked Congress for one more year and a bigger board, and a Senate committee agreed to a slightly shorter delay, until October 15, 2027. The bill still needs votes in the full Senate and the Chamber of Deputies, so until it becomes law, the December 1, 2026 date still applies to companies that collect data on people in Chile.

What the bill changes

The government's bill is short. It consists of a single article with four numbered amendments to Law 21.719 and two transitional provisions. Each targets a part of the law's institutional machinery rather than the rights and obligations it creates for companies. Quotations from the message below are translated from Spanish by PPC Land.

Entry into force

Law 21.719 was published in the Diario Oficial on December 13, 2024. Its first transitional article set entry into force on "the first day of the twenty-fourth month" after publication, which the message itself places at December 1, 2026. The bill replaces that formula with a fixed date, "1 de diciembre de 2027." The Senate committee later moved that date to October 15, 2027, according to Diario Estrategia. By PPC Land's calculation, the committee's version shortens the government's requested delay by 47 days, and still extends the original two-year transition to roughly 34 months from publication.

A five-member board

The regulator at the centre of the law is the Agencia de Protección de Datos Personales. Article 30 of the law, as described in the message, defines it as an autonomous public-law corporation of a technical nature, decentralised, with its own legal personality and assets. Its board, the Consejo Directivo, holds the agency's powers. The current text gives it three councillors, appointed by the President with the agreement of two-thirds of serving senators, for six-year terms with no reappointment and individual renewal every two years.

The bill raises the number of councillors to five and replaces individual renewal with partial renewal of the board every two years. It also raises the board's quorum from two councillors to three.

The government's reasoning rests on simple arithmetic. Under the existing rules, "the absence or abstention of one councillor reduces to two the number of members able to adopt decisions, while a second impediment prevents the Council from acting," the message states. "A composition of five members, with a minimum quorum of three, allows the Council to keep functioning in the event of a vacancy of one of its members and the temporary impediment of another."

The message cites precedent. When Chile's Congress debated Law 21.000, which created the financial markets regulator Comisión para el Mercado Financiero, the executive of the time proposed three full-time commissioners. The Senate Finance Committee warned that the absence of one would leave decisions to two people, and the executive accepted five. The message also points to the Central Bank of Chile's board, the Autonomous Fiscal Council and the Senior Public Management Council, all of which have five members, and argues that "in the case of technical bodies, a composition of five members offers better conditions of deliberation, continuity and institutional legitimacy."

The first appointments

The fourth transitional article governs how the first board gets named. The bill requires the first appointments to be made "at the latest, twelve months before" entry into force, replacing the current six-month rule. In a single proposal to the Senate, the President would name two people for two-year terms, two for four-year terms and one for a six-year term. The Senate votes on the slate as a unit and needs two-thirds of serving senators to approve it. If the Senate does not rule before the deadline, the proposal is deemed accepted.

A second transitional provision covers timing. If, when the amending law is published, fewer than twelve months remain before Law 21.719 takes effect, the first appointments must be made within ten days of publication. With the committee's October 15, 2027 date, that ten-day rule would almost certainly apply, since the twelve-month mark of October 15, 2026 has already passed.

Pay and exclusivity before the law starts

Under the law as it stands, councillors named before entry into force can exercise a limited set of functions: issuing instructions and general rules on personal data processing, running public information programmes, and setting the agency's internal rules and organisation. Any instruction or general rule they issue binds only once the law is in force. They must also propose the agency's statutes within ninety calendar days of their appointment.

The bill adds that councillors will be paid the monthly remuneration set in Article 30 septies from the date they are deemed appointed, and that from that date they are bound by the full-time dedication requirement and the incompatibility rules in the first paragraph of Article 30 quinquies. According to the message, those preparatory functions "require the effective exercise of the post from appointment."

Written warnings for every company

The fourth amendment is the one with the most direct effect on businesses. Law 21.719's sixth transitional article limits to smaller companies, as defined by Law 20.416, the agency's power to issue a written warning during the first twelve months the law is in force. The bill deletes that limitation, so the same option would extend to every entity subject to the law. The warning remains discretionary, and it is still recorded in the National Registry of Sanctions and Compliance, the public register of sanctioned controllers the law creates.

The message justifies the change by noting that "the legal, technical and organisational adjustments required by the new regulation cover all data controllers," not only small ones.

Funding

The first transitional provision of the bill says the additional fiscal cost in its first budget year will be paid from the budget of the Ministry of Economy, Development and Tourism, and from the Public Treasury for any shortfall. The message does not put a figure on that cost.

Why the government wants more time

The message frames the delay as a matter of sequencing. "The implementation of Law No. 21.719 constitutes a process of special complexity," it states, which requires keeping the new legal regime and the "effective installation" of the agency in step. Given the technical nature of the agency's functions, the board needs to be in place early enough to "adopt the regulatory definitions" that will guide the system.

It also invokes "the economic context the country is currently going through," along with the institutional, regulatory and operational challenges the regulation creates and the breadth of sectors it covers. The stated objective of the bill is to "strengthen the new institutional framework, allow its correct implementation and give data controllers a reasonable period to adapt their processes to the new legal requirements."

The message lists the workload the board faces. The agency must issue binding instructions and general rules on processing operations, set compliance and security standards and the costs associated with exercising data subject rights, provide guidance on impact assessments, determine which countries offer adequate protection and approve instruments for international transfers, certify and supervise infringement prevention models, run the sanctions registry, and handle rights protection and sanction procedures. "The composition of three councillors provided for in Article 30 quáter is insufficient for the adequate and timely exercise of these powers," the message concludes.

The message does not say so directly, but one fact shapes the whole debate: the board does not exist yet.

A board that has never been appointed

Law 21.719 originally required the first board to be appointed within the sixty days before entry into force, with councillors taking office only once the law applied. That rule was rewritten by Article 54 of Law 21.806, the public-sector pay adjustment law. As described in the message, the change required the first appointments to be made six months before entry into force, with the President's proposal submitted in a single act in a window between eighty and sixty days before that six-month mark. It also barred members of the ministerial advisory commission created to implement the law, set up by Decree No. 12 of 2025 of the Ministry General Secretariat of the Presidency, from sitting on the first board.

Six months before December 1, 2026 was June 1, 2026. That date passed without a board. According to Veredictum, citing the newspaper Pulso, the government's first slate of candidates was withdrawn. On May 20, 2026, the Senate rejected a second slate, made up of Joselyn Biermann for six years, Roberto Godoy for four and Matías Larraguibel for two, after it failed to reach the two-thirds threshold, according to Diario Estrategia.

Daniel Mas, the economy minister who co-signed the bill, said in August that finding people for the board had been difficult, according to Veredictum's account of the Pulso report. That report also said the government was weighing names including Leonardo Soto, Juan Francisco Galli and Roberto Godoy, and looking for women from the private sector and engineering for the remaining seats.

The message is signed by Kast, Mas, Finance Minister Jorge Quiroz Castro and José García Ruminot, Minister Secretary General of the Presidency.

What the Senate committee changed

The bill sat for seven weeks before the Constitution Committee, chaired by Senator Pedro Araya of the PPD, took it up on October 19. On that day the committee approved the idea of legislating by five votes to none, according to the law firm Jara del Favero, together with a separate parliamentary motion, Bulletin 18.060-07. Diario Financiero reported that Araya and Senators Jaime Quintana and Gastón Saavedra had filed their own motion to amend the law.

Karlfranz Koehler, the undersecretary of economy, presented the government's case for a 12-month delay while letting the agency start work immediately, according to Jara del Favero. Former senator Felipe Harboe proposed a different design: keep the rights and substantive obligations in force from December 1, 2026 and delay only the agency's supervisory and sanctioning powers by 12 months. According to Jara del Favero, Harboe argued that a full postponement would create legal uncertainty, leave gaps including for sensitive biological and genetic data, and could affect Chile's position on international data transfers.

Several senators had already signalled that a year was too long. In early October, Araya called a further year excessive, Senator Juan Luis Castro of the PS said the extension should not exceed 180 days, and Senator Matías Walker also questioned the length, according to Pauta, citing Pulso.

On October 26, the committee voted on about a dozen amendments from the executive and from senators and approved the bill in particular, according to Diario Estrategia. Besides the October 15, 2027 date, the committee kept the five-member board and rejected an amendment that would have lowered the Senate approval threshold for appointments from two-thirds to four-sevenths. The committee's version also reverses the term structure in the government's text: the President's first slate would include two people for six years, two for four years and one for two years. If the Senate rejects a slate, the President would have 15 days from notification to submit a new one, and the first proposal must come within ten days of the amending law's publication. The bill then moved to the Senate Finance Committee.

Senator Paulina Vodanovic, a member of the Constitution Committee, told Radio Pauta on October 27 that the government had wanted a one-year extension but that the committee considered it excessive. She said the extension cannot become a blank cheque or a prelude to another postponement, and that the resources for setting up the agency appeared insufficient, a question for the budget debate.

As of October 27, the bill was in its first constitutional stage in the Senate, carried "discusión inmediata" urgency, and had no floor votes recorded, according to the legislative tracker Voto Visible. It still requires a Senate floor vote, passage through the Chamber of Deputies, promulgation and publication. December 1, 2026 is less than five weeks away.

Business groups pushed for the delay, entrepreneurs did not

The delay did not originate only in the government. In August, the business confederation CPC, led by Susana Jiménez, the manufacturers' association Sofofa, led by Rosario Navarro, and the banking association ABIF argued for postponing the law because the agency had not been set up, according to El Desconcierto. The entrepreneurs' association Asech, led by Nicolás Shea, did not support a delay. Shea said most small companies were not ready but that this did not justify postponing the law, El Desconcierto reported.

Not all outside commentators accept the government's framing. Rodrigo Rojas, legal counsel at MBA Chile, told Radio Pauta that delaying the agency would prolong the difficulty of supervising and sanctioning violations, and pointed to everyday practices such as buildings and businesses demanding copies of both sides of national identity cards, and the circulation of medical and pharmacy purchase records.

What Law 21.719 requires of advertisers

The bill leaves the substance of Law 21.719 untouched, and that substance is broad. According to the Future of Privacy Forum's overview of the law, it applies to controllers and processors outside Chile when they offer goods or services to people in Chile, paid or free, or monitor their behaviour, including through profiling and tracking. That reach can extend to ad tech vendors, platforms and retailers with no office in the country.

Consent is the general legal basis, and according to FPF it must be free, informed, specific, prior and unequivocal. The law also allows processing on several other bases, including the controller's or a third party's legitimate interest, provided the data subject's rights and freedoms are not affected. People gain a right to portability and a right not to be subject to automated decisions with legal or significant effects, including profiling, which the law defines as automated processing to evaluate or predict aspects such as economic situation, health, preferences, behaviour, location or movements.

Sensitive data, the Chilean counterpart to what the GDPR calls special category data, includes socioeconomic situation, health, biometric data, the human biological profile and sexual orientation, and generally requires consent. Children under 14 need parental consent. International transfers need an adequacy determination by the agency, contractual clauses, binding corporate rules or another approved instrument.

The law's penalties scale with company size. According to FPF, fines reach 20,000 UTM, about $1.55 million at the conversion FPF used, and companies that are not small businesses face fines of 2% or 4% of the previous year's annual income for repeated serious or very serious violations. Sanctioned controllers appear in the national registry for five years.

Why this matters for the marketing community

For advertisers and ad tech firms operating in Chile, the bill changes the calendar, not the rulebook. Every obligation that profiling-based targeting, retargeting and cross-border data flows will have to meet is already written into Law 21.719. What the bill determines is when those obligations become enforceable, and who will interpret them first. The agency's first instructions on consent, profiling and transfers are where the statute's general text turns into operating rules, and none can be issued until a board is appointed.

The delay also has a regional dimension, and Brazil's regulator offers a contrast. The European Data Protection Board adopted its opinion on the Commission's draft Brazil adequacy decision in November 2025, finding the LGPD closely aligned with European principles while asking for scrutiny of the ANPD's independence. A month later, the ANPD approved its 2026-2027 enforcement priorities, which narrowed secondary-use enforcement to targeted advertising. Harboe's warning about Chile's position on international transfers points at the same question: a regulator that cannot convene cannot negotiate adequacy or approve transfer instruments.

Chile is not the only jurisdiction rescheduling digital rules. In May 2026, EU negotiators agreed to push the AI Act's high-risk deadlines for standalone systems to December 2, 2027, a date close to the one Chile's executive first proposed. Business pressure to soften existing regimes is not new either: Germany submitted a 19-page proposal in October 2025 seeking GDPR changes beyond the Commission's plans, and internal drafts of the Commission's Digital Omnibus would narrow the scope of personal and special-category data.

Staffing is the other constraint, and a law on paper does not guarantee enforcement. Portugal's regulator issued just two fines in all of 2025 despite opening 2,037 investigations, and attributed the low count to a shortage of specialised staff and paper-based procedures. Chile's government is asking for a larger board on similar grounds, while a senator on the committee says the resources set aside for the agency look insufficient.

The extension of written warnings to large companies deserves attention on its own. If the bill passes in its current form, a multinational platform found in violation during the law's first year would become eligible, at the agency's discretion, for the written warning that the current text reserves for smaller companies. The warning would still appear in the sanctions registry.

What happens next

What if Congress misses the date? The bill needs a Senate floor vote, approval by the Chamber of Deputies and publication before December 1, 2026 to prevent the original date from taking effect. If the amending law is not published in time, Law 21.719 would enter into force on that date without a board to apply it, the scenario the government says it wants to avoid. If it is, the President would have ten days from publication to send the Senate a five-name slate, which would still need two-thirds of serving senators, the threshold the May 2026 slate failed to reach.

Timeline

Summary

Who: Chile's government, through a message signed by President José Antonio Kast, Finance Minister Jorge Quiroz Castro, Minister Secretary General of the Presidency José García Ruminot and Economy Minister Daniel Mas Valdés, and the Senate Constitution Committee chaired by Senator Pedro Araya. Every company that processes personal data of people in Chile, including foreign advertisers and ad tech vendors that target or track them, is affected.

What: Bulletin 18.623-07 would postpone Law 21.719 on personal data protection, expand the Personal Data Protection Agency's board from three to five councillors with a quorum of three, require the first appointments within ten days of publication when less than twelve months remain, pay councillors from appointment, and extend to all companies the agency's option to issue written warnings in the law's first year. The committee set the new start date at October 15, 2027 instead of the government's December 1, 2027.

When: The message is dated August 31, 2026 and entered the Senate on September 1, 2026. The committee approved it in general on October 19 and in particular on October 26, 2026. The law's current start date is December 1, 2026.

Where: Chile's Senate, in the first constitutional stage, with the Chamber of Deputies still to vote. The law itself applies to entities outside Chile that offer goods or services to people in Chile or monitor their behaviour.

Why: The government says the agency, whose board has never been appointed after a slate failed in the Senate in May 2026, needs to be in place before the law applies, and that a three-member board cannot reliably reach quorum. Business groups sought the delay; some senators and commentators argue it postpones rights and enforcement without guaranteeing the agency will be ready.