Chile’s new statute Ley N°21.719 will take effect on 1 December 2026. It substantially revises and restructures the former Ley 19.628, establishes an independent personal‑data‑protection agency, and delivers a full‑fledged GDPR‑inspired data‑protection framework. It directly governs the full‑lifecycle processing of personal data such as phone numbers, communication logs and user consents carried out by A2P SMS and voice providers.
The law sets out eight core principles for data processing and expands data‑subject rights. Beyond access, rectification, erasure and objection, it adds rights to data portability and temporary data freezing. It defines multiple lawful bases for processing and imposes strict validity requirements for consent, prohibiting implied consent mechanisms such as pre‑checked boxes. The newly‑created Agencia de Protección de Datos Personales acts as an independent authority with powers to issue regulations, conduct inspections, receive user complaints and impose administrative sanctions; a national public register for sanctions and compliance is also established.
For the A2P sector, the legislation strengthens obligations for data security, security‑incident notification and cross‑border data transfers. Infringements are classified into three tiers: minor, serious and very serious. Very‑serious violations attract fines up to 20 000 UTM or up to 4 % of the undertaking’s annual turnover, alongside civil‑damage‑compensation remedies. Ley 19.628 remains applicable throughout the transition period. From 1 December 2026 the new law governs enforcement. A2P service providers need to adapt their systems, consent documentation and cross‑border‑data‑transfer arrangements.
