Constitutional Court approves new Chile Data Protection Act

The Data Protection Act is designed to align with existing international standards – in particular, Europe’s General Data Protection Regulation (GDPR).

The key changes introduced by the Data Protection Act are set out below.

• Creation of the Data Protection Agency. The Data Protection Act has granted the newly formed Personal Data Protection Agency the authority to oversee the application and interpretation of the Data Protection Act and to impose fines for non-compliance.
• Data subject rights and obligations on controllers. The Data Protection Act has introduced new data subject rights, such as rights to data portability and erasure, and new obligations on data controllers including a mandatory obligation to report data breaches.
• Legal bases for processing. The Data Protection Act expands the legal bases available for data processing such as legitimate interest and contractual obligations, alongside consent and legal authorisation.
• Sanctions Regime. The Data Protection Act has introduced a stringent sanctions system, classifying data protection violations as minor, serious, and very serious, with fines up to 20,000 UTM (USD 1,550,000) and potential civil liability for data protection violations.

Both Bills were passed by the Chilean Senate on August 28 2024 and approved by the President on September 3 2024. The Data Protection Act is now awaiting publication by Decree of the President.

The judgment of the Constitutional Court is available here, and the Bills are available here (in Spanish only).