Regulatory

Law 21,719 reshaped Chile's data protection regime, aligning it with the standards of the European GDPR. It imposes substantive obligations on every company that processes personal data: the principles of lawfulness, purpose limitation, proportionality, accuracy and security; an exhaustive list of legal bases for processing; duties of information, express consent and data subject rights (access, rectification, erasure, objection, portability and the right not to be subject to automated decisions); contracts with processors; international transfers with adequate safeguards; notification of security breaches within short deadlines; appointment of a DPO where required; and a record of processing activities.

We advise on designing and implementing the compliance programme: a gap analysis against the law, the privacy policy, updated contractual clauses, data protection impact assessments, procedures for responding to data subject requests, team training and an incident response plan. The programme has to work in practice, not only on paper.

Law 21,719 requires a Data Protection Officer to be appointed in organisations that process data at scale, handle sensitive data, or carry out activities requiring systematic monitoring. The DPO must have specialist knowledge, functional independence, adequate resources and a direct reporting line to senior management.

We advise on appointing the role internally or outsourcing it, defining its mandate and powers, designing how it interfaces with the business (IT, compliance, legal, HR, commercial), drafting the DPO's internal charter and notifying the Agencia de Protección de Datos Personales. Under the OGC model we can take on the role of external DPO directly, providing an integrated service with regular consultations, an annual compliance plan, training, handling of data subject requests and incident response.

Every industry operates under a sector-specific regulatory framework with its own supervisor, its own rules and its own compliance procedures. We advise companies regulated by the Comisión para el Mercado Financiero (CMF) across insurance, securities, banking and cooperatives, focusing on corporate governance, regulatory reporting, disclosure of material events and the prevention of insider dealing.

We also act before the Instituto de Salud Pública (ISP) on food, medical devices, cosmetics and health products; the Superintendencia de Electricidad y Combustibles (SEC); the Subsecretaría de Telecomunicaciones (SUBTEL) on concessions and value-added services; the SAG on agricultural matters; SERNAC on consumer matters; and the Fiscalía Nacional Económica (FNE) on competition and merger notifications. Our work covers obtaining licences, authorisations and permits, as well as ongoing compliance.

Official requests, information demands and investigations by regulators call for a precise technical response within strict deadlines. A poorly prepared answer raises the risk of enforcement proceedings sharply. We advise on receiving and analysing the request, gathering information internally (preserving legal privilege where it applies), coordinating with operations and IT, drafting the written response with its supporting documentation, and the follow-up afterwards.

In investigations (FNE, CMF, SERNAC, the data protection agency) we handle the full procedural strategy: appearances, documentary evidence, expert reports, submissions and any settlement route (leniency applications, conciliation, voluntary undertakings). The aim is to resolve the matter with the least possible operational and reputational impact.

When a regulator opens enforcement proceedings, the company faces substantial fines, temporary prohibitions, public exposure and knock-on risks (cancelled contracts, exclusion from tenders, third-party claims). We advise on the whole strategy: reviewing the charges as formulated, written submissions with documentary and expert evidence, presenting evidence, defence at hearings, administrative appeals for reconsideration and to the superior authority, and judicial review before the Court of Appeals within the statutory deadlines.

In complex matters we assess parallel routes such as conciliation agreements, a compliance programme as a mitigating factor, or self-reporting where appropriate. Every stage is aimed at reducing the sanction and keeping the business running.