By Belén Quezada

On January 1, 2025, Law 21.663, known as the Cybersecurity Framework Law, came into effect, marking the first regulation of its kind in Latin America. This law aims to establish an institutional and regulatory framework, define minimum cybersecurity requirements, delineate responsibilities and obligations, and implement control and supervision mechanisms. These elements are essential for promoting a safer and more resilient cyber environment.

One of the most notable aspects of this law is the creation of the National Cybersecurity Agency (ANCI), which began operations on January 2, 2025. The agency’s first director is Daniel Álvarez Valenzuela, a lawyer and Doctor of Law from the University of Chile, who has an outstanding track record in developing public policies on cybersecurity.

Who is subject to the Cybersecurity Framework Law?

The law applies to institutions that provide services classified as essential, including those mentioned in Article 4 of the law (such as state agencies, the National Electric Coordinator, private institutions engaged in banking, financial services, payment systems, among others), as well as those designated as such by the ANCI. Additionally, it covers institutions classified as Operators of Vital Importance (OIV), a designation also determined by the ANCI in the exercise of its functions.

What are the obligations imposed by the new law, and what is its purpose?

The obligations imposed by the law can be classified into three areas based on their temporal nature: preventive, informational (or transparency-related), and corrective.

Regarding prevention, the law mandates the implementation of cybersecurity protocols and standards defined by the ANCI, along with any specific standards that may exist in sectoral regulations. It is important to note that even with preventive measures in place, no system is entirely secure, and cybersecurity incidents can still occur. If such incidents arise, the law requires reporting any security breaches, which is crucial for several reasons:

• The potential danger of an incident in organizations that provide essential services or are classified as OIV.
• The impact not only on organizations but also on individuals.
• The ability to prevent other systems from being affected and to detect indications of potential attack campaigns.
• The use of these reports as inputs for studying and developing solutions to such breaches.

In terms of corrective measures, the law stipulates that institutions must adopt effective actions to control and mitigate the damages caused by a security incident and resolve issues arising from the breach. Additionally, organizations must take steps to ensure service continuity, even after an incident, so they can operate under the best possible conditions, even if they are limited.

It is evident that implementing the measures outlined in this law will strengthen the country’s cybersecurity environment. While these obligations apply only to certain companies, the established guidelines should serve as a reference for many other organizations.

When do the law’s provisions come into effect?

The general provisions of the Cybersecurity Framework Law came into effect on January 1, 2025. However, the classification of Operators of Vital Importance by the ANCI, as well as their specific duties, the obligation to report cybersecurity incidents, and the enforcement of sanctions established by the law, will take effect on March 1, 2025.

Relation to existing cybercrime regulations

The Cybersecurity Framework Law also ties into existing regulations on cybercrime in Chile, such as Law 19.223 on cybercrimes, which criminalizes offenses like unauthorized access to IT systems, espionage, and data manipulation. In fact, Law 21.663 strengthens the security and protection framework against these crimes by requiring organizations to adopt preventive and corrective measures in response to incidents that could lead to illegal activities in cyberspace. By mandating the reporting of security breaches and the implementation of damage mitigation measures, the law also facilitates the identification and prosecution of cybercrimes, aligning with national efforts to combat cybercrime and protect the country’s critical infrastructure.

Part of a broader security agenda

The Cybersecurity Framework Law is part of the government’s priority agenda on security and is integrated into the Government’s Security Strategy, focusing on institutional strengthening, combating organized crime—especially cybercrime—and promoting state agreements on security issues. Notably, in this same context, the recently enacted Law 21.730, which establishes the Ministry of Public Security and was promulgated on January 27, 2025, assigns this ministry the responsibility of designing policies, plans, and programs related to cybersecurity. Through the Ministry of Public Security, the ANCI will communicate with the President to fulfill its functions.

What do these changes imply?

It is essential for organizations to undergo a cultural shift, fostering greater awareness of cybersecurity and digital information protection. Human capital must possess advanced knowledge in these areas, along with the necessary tools to respond effectively to a cybersecurity attack or incident, thereby minimizing impact and enhancing organizational resilience.

This law ensures that these measures are implemented in institutions providing essential services and in OIVs, with penalties for non-compliance reaching up to 40,000 UTM.

The Cybersecurity Framework Law is not solely a technical or IT-related issue within a company; rather, it has a cross-cutting impact across the entire organization. Therefore, obtaining proper legal guidance in policy implementation, incident management, and the protection of affected individuals’ rights is crucial to ensuring organizational resilience. Thus, this law will not merely serve as a regulatory framework on paper but as an effective tool for safeguarding all stakeholders involved.

Link to the original article