Personal Data Processing Authorization Chile

Personal Data Processing Authorization Chile (Autorización de Tratamiento de Datos Personales) is a legal consent document by which a natural person (the titular de los datos / data subject) grants specific, informed, free, and unambiguous written authorization for a named data controller (responsable del tratamiento) to collect, store, use, transmit, or otherwise process their personal data for defined purposes. This authorization is required by Ley 19.628 (Ley sobre protección de la vida privada) Article 4, which mandates that personal data processing requires the express prior consent of the data subject — and is now comprehensively updated by Ley 21.719 of 2024 (Ley que modifica la Ley N.° 19.628, sobre protección de la vida privada), which aligns Chile's data protection framework with the European Union's General Data Protection Regulation (GDPR) model.

Ley 19.628, enacted in 1999, established Chile's first comprehensive personal data protection regime — requiring express written consent for the processing of personal data, establishing rights of access, rectification, and deletion (habeas data), and creating the Consejo para la Transparencia (CPLT) as the supervisory authority for public sector data. The law's definition of 'datos personales' in Article 2 covers any information relating to natural persons that identifies or makes identifiable the person concerned — including names, RUT numbers, addresses, telephone numbers, email addresses, health data, financial information, biometric data, and images.

Ley 21.719, enacted in 2024, substantially modernizes Chile's data protection framework by: creating a new independent supervisory authority — the Agencia de Protección de Datos Personales (APDP) — with investigative, sanctioning, and regulatory powers comparable to European Data Protection Authorities; introducing GDPR-aligned principles including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability (responsabilidad proactiva); establishing a comprehensive framework for sensitive personal data (datos sensibles) including health, biometric, genetic, religious, political, sexual orientation, and other categories requiring heightened protection; creating new rights for data subjects including portability (portabilidad), erasure (supresión), and restriction of processing (limitación del tratamiento); and imposing significant financial sanctions for violations.

For consent to be valid under Ley 21.719, it must be: specific (específico) — not bundled with terms of service or general agreements; informed (informado) — the data subject must receive all required disclosures about purposes, categories of data, recipients, retention periods, and their rights before signing; free (libre) — not conditioned on the provision of a service where consent is not necessary for that service; unambiguous (inequívoco) — expressed through a clear affirmative action (not silence or pre-ticked boxes); and verifiable (verificable) — the data controller must be able to demonstrate that valid consent was obtained and retained. This Autorización de Tratamiento de Datos Personales document is designed to meet all these requirements.

The Agencia de Protección de Datos Personales, once fully operational under Ley 21.719, will have authority to conduct investigations, issue binding orders, and impose administrative sanctions of up to 5,000 Unidades Tributarias Mensuales (UTM) for serious violations. The APDP will also register data processors and maintain a public registry of data protection officers (DPOs / Encargados de Protección de Datos) for entities required to appoint them under the law.

A Personal Data Processing Authorization Chile under Ley 19.628 and Ley 21.719 is required whenever a data controller collects and processes personal data from individuals in Chile without relying on another lawful basis (such as legal obligation, contract performance, vital interests, or legitimate interest).

E-commerce and digital services: Online retailers, subscription services, apps, and digital platforms operating in Chile must obtain consent for processing personal data that goes beyond the minimum needed to perform the contracted service — particularly for marketing communications, behavioral analytics, remarketing, and data sharing with third parties or advertising networks. The Agencia de Protección de Datos Personales under Ley 21.719 is empowered to investigate and sanction digital platforms.

Marketing and CRM: Businesses sending marketing emails, SMS campaigns, or conducting telemarketing to individuals in Chile must have documented prior consent under Ley 19.628 Article 4 and Ley 21.719. The Servicio Nacional del Consumidor (SERNAC) also has jurisdiction over commercial communication practices under Ley 19.496 (Ley del Consumidor), requiring clear opt-in consent for commercial communications.

Employee data in the workplace: Employers collecting employee data beyond what is strictly necessary for the employment relationship — such as health data, GPS tracking, biometric time-attendance systems, or social media monitoring — must obtain explicit written consent from employees under Ley 19.628 and the Dirección del Trabajo (DT) guidance on employee privacy rights. The DT has issued ORD N.° 260 and subsequent circulares addressing employer data collection obligations.

Healthcare and research: Hospitals, clínicas, research institutions, and clinical trial operators processing personal health data (datos sensibles under Ley 19.628 Article 2 and Ley 21.719) must obtain specific written consent for each distinct processing purpose beyond direct patient care — research, teaching, registry participation, or commercial use. MINSAL and the Fondo Nacional de Salud (FONASA) data governance policies require documented consent for secondary health data uses.

Financial services and credit bureaus: Banks regulated by the CMF (Comisión para el Mercado Financiero), insurance companies (aseguradoras), and credit information agencies such as DICOM (part of Equifax Chile) processing personal financial data must comply with Ley 19.628 and the specific data protection provisions of financial services legislation, including authorization for sharing data with credit bureaus and third-party financial service providers.

A legally valid Personal Data Processing Authorization Chile under Ley 19.628 Article 4 and Ley 21.719 of 2024 must include the following essential elements to satisfy the requirements of the Agencia de Protección de Datos Personales and the GDPR-aligned standards now applicable in Chile:

Identification of the Data Subject (Identificación del Titular): Full name, RUT, and contact information of the person whose personal data will be processed. The data subject must be a natural person (persona natural) with legal capacity — for minors, the parent or legal guardian provides consent as per the minor's data protection provisions of Ley 21.719.

Identification of the Data Controller (Identificación del Responsable del Tratamiento): Full legal name, RUT, legal address, and representative's name and contact details for the entity or person who will be processing the personal data. Under Ley 21.719, the data controller must provide contact information for their designated Encargado de Protección de Datos (DPO) if one is required. The data controller assumes full legal responsibility for compliance.

Categories of Personal Data (Categorías de Datos Personales): A specific enumeration of the types of personal data that will be collected and processed — full name, RUT, address, telephone number, email, date of birth, employment information, financial data, health data, biometric data, browsing behavior, location data, or others. Ley 21.719 requires data minimization — only data necessary for the stated purpose may be collected.

Purpose of Processing (Finalidad del Tratamiento): A precise and specific statement of the purposes for which the data will be processed — direct marketing, customer relationship management, service provision, research, statistical analysis, credit assessment, employee administration, or others. Under the purpose limitation principle of Ley 21.719, data cannot be used for purposes incompatible with those stated in the authorization without obtaining new consent.

Legal Basis for Processing (Base Legal del Tratamiento): Confirmation that the authorization is the legal basis for this specific processing activity. Under Ley 21.719, data controllers must identify the applicable legal basis for each processing activity — consent (Article 12 et seq.), contract performance, legal obligation, vital interests, public task, or legitimate interest. For data processed on the basis of consent, this authorization document is the legal basis.

Data Recipients and Transfers (Destinatarios y Transferencias de Datos): Clear disclosure of whether personal data will be shared with third parties — affiliated companies, service providers (encargados del tratamiento), data brokers, marketing platforms, government agencies, or foreign recipients. For international data transfers (transferencias internacionales), Ley 21.719 requires disclosure of the destination country and the safeguards in place (adequacy decision, standard contractual clauses, binding corporate rules, or other mechanisms).

Data Retention Period (Plazo de Retención): The period for which personal data will be retained, or the criteria used to determine that period. Under the storage limitation principle of Ley 21.719, data must be deleted or anonymized when no longer needed for the stated purpose. The specific retention period applicable to the processing activity must be disclosed to the data subject.

Data Subject Rights (Derechos del Titular): Notification of the data subject's rights under Ley 21.719 — access (acceso), rectification (rectificación), erasure/deletion (supresión/cancelación), restriction of processing (limitación del tratamiento), portability (portabilidad), objection (oposición), and withdrawal of consent (revocación del consentimiento). Contact information for exercising these rights — an email address, postal address, or online form — must be provided. Under Ley 21.719, data controllers must respond to access and deletion requests within 30 business days.

Contact of the Agencia de Protección de Datos Personales (APDP): Under Ley 21.719, data subjects must be informed of their right to lodge a complaint with the Agencia de Protección de Datos Personales (www.agenciaprivacidad.cl) if they believe their data protection rights have been violated.

Forms-legal.com provides this Personal Data Processing Authorization Chile template as a reference starting point for data controllers and individuals. Given the significant regulatory changes introduced by Ley 21.719 of 2024 and the sanctions regime administered by the Agencia de Protección de Datos Personales, organizations processing personal data in Chile should have their consent forms and data processing practices reviewed by an abogado specializing in derecho digital and data protection compliance. Los usuarios de forms-legal.com pueden descargar este documento de forma gratuita en formato PDF o DOCX, completar los campos del formulario guiado y obtener un documento listo para firma.