Company Data Privacy Agreement Chile (Acuerdo de Privacidad de Datos Empresa)

A Company Data Privacy Agreement Chile (Acuerdo de Privacidad de Datos Empresa) is a formal written instrument by which a company (empresa) establishes the legal framework governing its collection, storage, processing, transfer, and deletion of personal data (datos personales) in Chile, in compliance with Ley 19.628 of 1999 (Ley sobre Protección de la Vida Privada) — Chile's original data protection statute — and Ley 21.719 of 2024, the landmark new data protection law that fundamentally modernizes Chile's privacy framework to align with international standards, including the EU General Data Protection Regulation (GDPR) and the OECD Guidelines on Privacy and Transborder Flows of Personal Data.

Ley 21.719 of 2024 was enacted on December 13, 2024 and published in the Diario Oficial on December 14, 2024. With a 24-month implementation period, all Chilean companies must achieve full compliance by December 2026. The law creates the Agencia de Protección de Datos Personales — an autonomous public agency reporting to the Presidente de la República through the Ministerio Secretaría General de la Presidencia — as Chile's dedicated data protection authority with powers to investigate, sanction, and issue binding guidelines. The Agencia replaces the fragmented enforcement system under Ley 19.628 (which assigned jurisdiction to ordinary civil courts).

Ley 21.719 introduces fundamental changes to Chile's data protection landscape: (a) expanded definitions of datos personales to include genetic data, biometric data, health data, location data, and behavioural profiling data as datos sensibles; (b) mandatory legal bases for all personal data processing — consent (consentimiento), legitimate interest (interés legítimo), contractual necessity (necesidad contractual), legal obligation (obligación legal), vital interests (intereses vitales), and public interest (interés público); (c) formal data controller (responsable del tratamiento) and data processor (encargado del tratamiento) distinction with mandatory Data Processing Agreements (DPA or Acuerdo de Tratamiento de Datos); (d) mandatory Data Protection Officer (DPO or Delegado de Protección de Datos) for organizations processing large-scale sensitive data; (e) strengthened individual rights — ARCOP rights (Acceso, Rectificación, Cancelación, Oposición, and Portabilidad — data portability, a new right added by Ley 21.719); and (f) mandatory breach notification to the Agencia within 72 hours of discovery for high-risk incidents.

Under Ley 19.628 (still in force until Ley 21.719's implementation deadline in December 2026), personal data may only be processed with the data subject's consent (consentimiento del titular) or when authorized by a specific legal provision. Article 4 of Ley 19.628 defines personal data (datos de carácter personal) as any information concerning identified or identifiable natural persons. Article 2 letter g) defines datos sensibles as those referring to physical or moral characteristics, ethnic or racial origin, trade union membership, religious or philosophical beliefs, health conditions, and sexual preferences. The SERNAC (Servicio Nacional del Consumidor) exercises complementary consumer data protection under Ley 19.496 in commercial contexts.

For cross-border data transfers, Article 17 of Ley 21.719 establishes a GDPR-style adequacy framework: transfers to countries with an adequate level of protection (determined by the Agencia) are permitted freely; transfers to inadequate jurisdictions require appropriate safeguards (standard contractual clauses approved by the Agencia, binding corporate rules, or specific derogations). The Agencia de Protección de Datos Personales will publish the list of adequate countries and approved standard contractual clauses after its establishment during the 2025–2026 transition period.

A Company Data Privacy Agreement Chile is needed by every Chilean company or foreign company operating in Chile that collects, stores, processes, or transfers personal data of Chilean residents — which encompasses virtually every business with employees, customers, suppliers, or a website with analytics. Under the transitional framework of Ley 21.719 of 2024, all organizations must review and update their data processing practices, internal policies, and contractual framework before December 2026.

The agreement is needed when a company engages an external service provider (encargado del tratamiento) to process personal data on its behalf — including cloud computing providers (AWS, Azure, Google Cloud), payroll processing companies, CRM software providers, marketing platforms, HR management systems, and any SaaS provider processing Chilean personal data. Ley 21.719 Article 14 requires a written Data Processing Agreement (Acuerdo de Tratamiento de Datos) between the data controller (responsable) and any data processor (encargado), specifying the processing scope, security measures, subprocessor rules, and instructions for data return or deletion.

The agreement is required when conducting large-scale data collection activities governed by the Agencia de Protección de Datos Personales: customer databases with marketing profiling, employee monitoring systems, loyalty programs with behavioural tracking, call center recordings, CCTV systems in commercial premises, biometric access control, and health screening data collected from employees. Under Ley 21.719 Article 38, organizations processing sensitive data at large scale or engaging in systematic profiling must designate a Delegado de Protección de Datos (DPO) and register with the Agencia.

For companies subject to sector-specific regulations — financial institutions supervised by the CMF under Ley 20.950 (data portability), health providers under the MINSAL's Norma Técnica de Seguridad de la Información en Salud, telecommunications companies under the Ley General de Telecomunicaciones (Ley 18.168) and the Subsecretaría de Telecomunicaciones (SUBTEL), and critical infrastructure operators under the Ley Marco de Ciberseguridad (Ley 21.663 of 2025) — the Data Privacy Agreement must incorporate sector-specific requirements alongside Ley 21.719 obligations.

The agreement is needed for companies making cross-border data transfers to group companies, cloud providers, or data processors located outside Chile — Ley 21.719 Article 17 requires that such transfers be covered by an adequacy decision from the Agencia or by appropriate contractual safeguards (standard contractual clauses, binding corporate rules, or specific derogations for data subject consent, vital interests, or public interest).

The Agencia de Protección de Datos Personales may impose fines of up to 5,000 UTM (approximately CLP 330 million in 2025) for serious violations and 10,000 UTM for very serious violations under Ley 21.719 Article 47 — making documented Data Privacy Agreements an essential risk management tool for all Chilean companies.

A valid Company Data Privacy Agreement Chile under Ley 21.719/2024 and Ley 19.628/1999 must contain these essential elements to be enforceable and compliant with the Agencia de Protección de Datos Personales requirements.

Party Identification and Roles: Full legal name, RUT (SII), and address of the data controller (responsable del tratamiento) and, if applicable, the data processor (encargado del tratamiento). The agreement must clearly define which party is the responsable (who determines the purposes and means of processing) and which is the encargado (who processes data only on the responsable's instructions). Under Ley 21.719 Article 5, joint controllers (corresponsables) must document their respective responsibilities in writing.

Categories of Personal Data Processed: Precise description of the categories of personal data (categorías de datos personales) subject to the agreement — distinguishing between ordinary personal data (datos personales) and sensitive personal data (datos sensibles) as defined in Article 2 of Ley 19.628 and expanded by Article 4 of Ley 21.719 to include genetic data, biometric data, health data, financial data, criminal record data, location data, and profiling data. The agreement must identify the data subjects (titulares de datos) — employees, customers, suppliers, website users, etc.

Legal Basis for Processing: For each processing activity, the legal basis (habilitación legal) under Ley 21.719 Articles 12–18 must be documented: consent (consentimiento libre, informado, específico, e inequívoco under Article 12); contractual necessity (necesidad para la ejecución de un contrato under Article 13); legal obligation (obligación legal under Article 14); legitimate interest (interés legítimo under Article 15 — requiring a balancing test between the controller's interest and the data subject's rights); vital interests (intereses vitales under Article 16); or public interest (interés público under Article 17).

Data Subject Rights — ARCOP: The agreement must establish the procedures for data subjects to exercise their ARCOP rights under Ley 21.719 Articles 20–30: Acceso (access — free copy of personal data within 15 business days); Rectificación (correction — of inaccurate data within 5 business days); Cancelación (deletion — upon legitimate grounds within 15 business days, subject to legal retention obligations); Oposición (objection — to processing for direct marketing, profiling, or under legitimate interest grounds); and Portabilidad (portability — new right under Ley 21.719, requiring data delivery in a structured, commonly used machine-readable format within 15 business days). The designated contact point (punto de contacto o Delegado de Protección de Datos) for ARCOP requests must be identified.

Data Security Measures: Technical and organizational security measures (medidas de seguridad técnicas y organizativas) proportionate to the risks of the processing — including data encryption (cifrado), access controls (control de acceso), audit logging (registro de auditoría), anonymization and pseudonymization procedures, and security incident response protocols. Under Ley 21.719 Article 46, the controller must implement security measures and document them in a security policy (política de seguridad de la información).

Data Breach Notification: The obligation to notify the Agencia de Protección de Datos Personales within 72 hours of discovering a high-risk personal data breach (brecha de datos personales de alto riesgo) under Ley 21.719 Article 48, and to notify affected data subjects without undue delay when the breach is likely to result in high risk to their rights. The agreement should specify the internal incident response procedure — identification, containment, assessment, notification — aligned with the Agencia's breach notification guidelines and the Ley Marco de Ciberseguridad (Ley 21.663 of 2025) incident reporting obligations for critical infrastructure operators.

Data Processor Obligations (Encargado del Tratamiento): When the agreement governs a controller-processor relationship under Ley 21.719 Article 14, the data processor must: process data only on documented instructions from the controller; maintain confidentiality; implement the required security measures; not engage sub-processors without prior written authorization from the controller; assist the controller in fulfilling data subject rights requests and breach notification obligations; and delete or return all personal data upon termination of the processing relationship.

Cross-Border Data Transfers: Conditions for transferring personal data outside Chile under Ley 21.719 Article 17 — identification of the destination country and legal basis for the transfer (adequacy decision from the Agencia, standard contractual clauses, binding corporate rules, or specific derogation). Reference to the Agencia's list of adequate countries (to be published by the Agencia during the 2025–2026 transition).

Delegado de Protección de Datos (DPO): For organizations required to designate a DPO under Ley 21.719 Article 38 — the DPO's name, contact details, and role description. The DPO must be registered with the Agencia and have the necessary qualifications in data protection law and practice.

Forms-legal.com provides this Company Data Privacy Agreement Chile template as a practical starting point for Ley 21.719 compliance. Every data privacy agreement should be reviewed by a licensed Abogado specializing in Chilean data protection law, aligned with the guidelines issued by the Agencia de Protección de Datos Personales during its operational phase. Los usuarios de forms-legal.com pueden descargar este documento de forma gratuita en formato PDF o DOCX, completar los campos del formulario guiado y obtener un documento listo para firma.