Chile’s Law for the Protection of Private Life, Ley N°19.628, is the currently‑applicable statute governing personal‑data protection. It constitutes the main legal ground used by regulators to resolve data‑compliance cases involving A2P SMS and bulk‑voice services. The law defines personal data and sensitive personal data, establishes lawful bases for processing, sets out data‑subject rights, and lays down a full regime covering security‑confidentiality rules, cross‑border personal‑data transfers and tiered administrative penalties. Chile’s ANPD, SUBTEL and SERNAC conduct administrative supervision based on this text, while the updated data‑protection law Ley 21719 is not yet in force.
The law applies to all personal‑data‑processing operations carried out by public and private entities, including scenarios where A2P service providers store mobile‑phone numbers, communication records and evidence of user marketing consent. Data processing ordinarily requires explicit consent from the data subject, though statutory exceptions dispensing with consent are enumerated. Natural persons are granted rights of access, rectification, erasure and objection; enterprises shall implement corresponding handling and reply procedures.
For A2P operational practice, the law mandates service providers to enforce information‑security and confidentiality safeguards and preserve records of SMS dispatches and opt‑out events. It imposes constraints on exporting Chilean users’ personal data overseas, prohibiting arbitrary cross‑border transfers. Infringements are classified as minor, serious or very‑serious with graduated fines capped at 20000 UTM.
Ley N°19.628 will be superseded by Ley 21719, whose effective date is set for 1 December 2026. Until the new law comes into effect, Ley N°19.628 remains the binding compliance reference for all commercial‑communication activities.
