Ley 21.719: A Checklist to Prepare Your Website and Marketing Before December 1

Does your website have a contact form? Do you send newsletters? Do you respond to quote requests on WhatsApp? Then you process personal data, and starting December 1, 2026, new rules will apply.

Ley 21.719 (Chile's new personal data protection law) amends the existing Ley 19.628, creates the Agencia de Protección de Datos Personales (Chile's Data Protection Agency), and establishes fines that can reach thousands of UTM, Chile's monthly tax units. The good news: much of the work for a small or medium-sized business involves places you already know—your website, forms, contact database, and marketing tools. Here's a practical checklist, without the fine print.

When Does Ley 21.719 Take Effect, and Will It Be Postponed?

The law was published on December 13, 2024. Its first transitional article states that it takes effect on "the first day of the twenty-fourth month following publication," meaning December 1, 2026. That is how it appears in LeyChile, which lists it as having "entry into force deferred until December 1, 2026."

What about the postponement people are discussing? It is real, but it is not law yet. On August 31, 2026, the government signed a bill (boletín 18.623-07) that would move the date to December 1, 2027. As of October 11, 2026, the Senate lists it as "In progress," with an introduction date of September 1. Until it is approved and published, December 1, 2026, remains the controlling date. Our advice: plan around that date.

The Basics: When Can You Process Personal Data?

The law starts with a general rule: processing is lawful when the person gives their consent (Article 12). That consent must be freely given, informed, and specific to the purpose, and given in advance and unambiguously, for example through a written or electronic statement or a clear affirmative action. The person can also withdraw it at any time, using means similar to those used to give it; those means must be prompt, free of charge, and always available.

Article 13 adds other legal bases that do not require consent, including:

• When processing is necessary to enter into or perform a contract with the person, or for precontractual steps they requested (for example, preparing the quote they asked you for).
• When a legal obligation requires it.
• When it is necessary for your legitimate interest or that of a third party, provided it does not affect the person's rights. The person can always ask you to explain what that interest is.

Keep one key detail in mind: you must be able to substantiate the legal basis (Article 13, final paragraph). If you cannot demonstrate it, for practical purposes it is as if you did not have one.

A Ley 21.719 Checklist for Small Businesses: Websites and Marketing

1. Website Forms: Ask Only for What You Need and Separate Permissions

• Review every form (contact, quote request, ebook download, checkout) and remove fields you do not need. The law considers processing data unnecessary for the purpose a serious violation (Article 34 ter, letter c).
• If you also want to send advertising, use a separate, unchecked box for that permission. Requesting a quote and accepting a newsletter are different purposes.
• Next to the form, explain how you will use the data and link to your privacy notice.
• Keep evidence of consent: the date, form, and wording accepted.

2. Cookies, Pixels, and Analytics

The law does not mention cookies by name. But if your analytics or advertising tags (Google Analytics, Meta Pixel, Google Ads) process personal data for a purpose that relies on consent, the same rules in Article 12 apply: prior, specific, and revocable consent. In practice:

• Take inventory of the tags that load on your website.
• Evaluate with your legal advisor whether you need a consent banner that blocks nonessential tags until the person accepts and makes withdrawing permission just as easy.

3. A Privacy Notice or Policy on Your Website

Article 14 ter requires you to keep at least the following permanently available to the public on your website, or through an equivalent medium:

• Your data processing policy, with a date and version.
• The identity of the data controller and its legal representative.
• A mailing address, email address, form, or equivalent channel for receiving requests.
• What data you process, whose data it is, who you disclose it to, for what purposes, and on what legal basis (including the legitimate interest, if you use one).
• Your security policy and measures.
• People's rights and their right to file a complaint with the Agency.

Failure to meet this information requirement is considered a minor violation (Article 34 bis, letter a). If your website does not have an up-to-date policy, this is the first issue worth addressing. We can help you implement it on your website through Web Development.

4. Email Marketing and Databases

• Review where your contacts come from. If you do not know the legal basis on which they were obtained, do not use them for campaigns until you clarify it.
• Include a simple way to unsubscribe in every message. Article 8 recognizes the right to object when processing is for direct marketing purposes, including profiling.
• Process unsubscribe requests across all your tools, not just your email platform.
• Clean up old or outdated databases. Processing inaccurate or outdated data can also be a serious violation (Article 34 ter, letter d).

5. WhatsApp, CRM, and AI Automation

Your CRM and WhatsApp conversations also contain personal data. Apply the same approach:

• Define who on your team can access which information.
• Do not reuse contacts who came through customer service for campaigns without a legal basis that permits it.
• If you use AI or automation to make a decision about a person, remember that Article 8 bis gives them the right to object to decisions based solely on automated processing that significantly affect them, and to request human intervention. For guidance on connecting AI agents responsibly, see our article on AI risks and secure agents.

6. Providers and Data Processors

Your email platform, hosting provider, CRM, or agency may process data on your behalf. Article 15 bis governs that relationship:

• Make sure you have a contract that establishes the scope of the assignment, its duration, its purpose, and the type of data processed, among other elements.
• The processor may process data only according to your instructions. If it uses the data for another purpose, the law considers it a data controller for all purposes.

7. People's Rights: Access, Rectification, Erasure, Objection, and Portability

In addition to the traditional ARCO rights (access, rectification, cancellation, and objection), the law introduces portability: obtaining a copy of the data in a structured, commonly used electronic format and transferring it to another controller. It also adds temporary blocking of processing while a request is being resolved (Article 8 ter).

• Set up a dedicated email address or form to receive these requests.
• Prepare to meet the deadlines in Article 11: acknowledge receipt and respond within 30 calendar days, with a one-time extension of another 30 days.
• Keep a record of every response sent, because the law requires you to be able to demonstrate it.

8. Security and Breach Reporting

• Apply security measures appropriate to the risk (Article 14 quinquies). The law mentions, among other measures, pseudonymization and encryption, and the ability to restore data quickly after an incident. Backups, strong passwords, two-factor authentication, and up-to-date software are a good starting point. Our Hosting and Support service includes daily backups and monitoring.
• Define an incident protocol. Article 14 sexies requires you to report to the Agency, without undue delay, security breaches that create a reasonable risk to people, and to record them. If they involve sensitive data, data belonging to children under 14, or financial or commercial data, you must also notify the affected individuals in clear language.

9. Penalties and the New Agency

The Agencia de Protección de Datos Personales is an autonomous body that maintains its relationship with the President through the Ministry of Economy (Article 30). Among other functions, it will be able to issue general instructions and oversee compliance. The fines under Article 35 are:

Repeat violations are an aggravating factor, and there will also be a public Registro Nacional de Sanciones y Cumplimiento (National Register of Penalties and Compliance) (Article 39). There is transitional relief for smaller businesses: during the first 12 months the law is in effect, when a penalty is warranted, the Agency may issue a written warning (sixth transitional article). Article 14 septies also states that information and security standards will take company size into account. That does not exempt you from compliance.

Frequently Asked Questions About Ley 21.719

When Does Chile's New Personal Data Law Take Effect?

Starting December 1, 2026, under its first transitional article. There is a bill to postpone it until December 2027 (boletín 18.623-07), but as of October 11, 2026, it remains in progress in the Senate.

Does It Apply to My Business Even if It Is Small?

Yes. The law applies to all data processing carried out by an individual or legal entity. What varies by size are certain compliance standards and, during the first year, the possibility of receiving a warning instead of a fine.

Do I Need Consent to Send Newsletters?

It depends on the legal basis on which you obtained the contact. Consent is the general rule, and people can always object to direct marketing. Review your situation with your legal advisor.

How Long Do I Have to Respond to an Access or Erasure Request?

30 calendar days from receipt of the request, with a one-time extension of another 30 days (Article 11).

Does This Checklist Replace a Lawyer?

No. It is an informational, operational guide to organizing your website and marketing. Compliance decisions must be validated with your legal advisor, as we explain in our Terms and Conditions.

Get Your Website and Marketing Organized Before December 1

At Tucango, we help you with the technical and operational side: forms with consent, a visible privacy notice, tag configuration, and an organized contact database for your campaigns.

Review your digital marketing strategy → · Update your website →

This article is informational and provides a technical and operational perspective based on our experience implementing websites and campaigns; it does not replace specialized legal advice. See our Terms and Conditions and Privacy Policy for more details.

---

Sources

1. Ley 21.719: regulates the protection and processing of personal data and creates the Agencia de Protección de Datos Personales. Biblioteca del Congreso Nacional (Library of the National Congress), LeyChile (version with entry into force deferred until December 1, 2026; published December 13, 2024; last amended February 5, 2026, by Ley 21.806). Articles cited: 8°, 8° bis, 8° ter, 11, 12, 13, 14 ter, 14 quinquies, 14 sexies, 14 septies, 15 bis, 30, 34 bis, 34 ter, 35, 39, and the first and sixth transitional articles. https://www.bcn.cl/leychile/Navegar?idNorma=1209272
2. Message proposing amendments to Ley 21.719 (boletín 18.623-07), dated in Santiago on August 31, 2026. Cámara de Diputadas y Diputados de Chile (Chamber of Deputies of Chile). https://www.camara.cl/verDoc.aspx?prmID=18854&prmTIPO=INICIATIVA
3. Legislative proceedings: boletín 18623-07, "In progress," dated September 1, 2026. Senado de la República de Chile (Senate of the Republic of Chile), accessed October 11, 2026. https://www.senado.cl/appsenado/templates/tramitacion/index.php?boletin_ini=18623-07
4. Terms and Conditions (Section 19, "Regulatory guidance (not legal advice)") and Privacy Policy. Tucango. https://tucango.com/terminos · https://tucango.com/privacidad