• The creation of the Agency for Personal Data Protection has been announced, an entity responsible for overseeing compliance with the law and promoting education on data protection. Alongside this, the role of the Data Protection Officer has been introduced, tasked with ensuring compliance within organizations and serving as a liaison with the Agency.

• From now on, companies must obtain clear and explicit consent from individuals for the storage and processing of their personal data. It is crucial for businesses to review and adjust their privacy policies and the mechanisms through which users provide their consent.

Santiago, December 20, 2024 – Companies will face a significant transformation with the implementation of the new Data Protection Law, aimed at enhancing citizen protection and raising care standards. This law aligns Chile with a more modern and comprehensive regulatory framework.

The new regulation includes the establishment of the Agency for Personal Data Protection, a body tasked with enforcing compliance, sanctioning violations, and guiding citizens in exercising their rights. Among its powers is the ability to impose fines for breaches of the law.

“The Data Protection Law sets a new standard in safeguarding personal information, sending a clear message to citizens: their data is valuable and belongs to them. For companies, this represents the challenge of integrating these new measures into their operations. Those that do so effectively will not only stand out for their transparency and rigor in handling data but also gain a competitive edge, fostering customer loyalty and sustained market success,” said Belén Quezada, Senior Associate at Apparcel Uriarte.

From a business perspective, Quezada emphasized the importance of first becoming familiar with the new law. Organizations should take the time to review and understand it at all levels where personal data is collected, stored, and/or processed. She outlined a roadmap for compliance:

1. Mapping Data Usage: Identify what data is collected, its purpose, whether it will be shared with third parties, and why. Essentially, conduct a current diagnostic of the company’s data practices.
2. Consent: Ensure that all personal data collection is backed by explicit consent from the individuals unless another lawful basis applies.
3. Responsible Use of Information: Personal data should only be used for the purposes for which it was collected.
4. Activity Records: Each department and area must contribute to creating a comprehensive record of all data processing activities, allowing for monitoring and understanding.
5. Training and Awareness: Engage everyone in the company to understand the risks and responsibilities associated with data protection.
6. Data Protection Officer: Appoint a person responsible for ensuring compliance with the law and maintaining communication with the Agency for Personal Data Protection.
7. Incident Response Protocol: Prepare for swift action in case of any security incidents related to personal data. Having a pre-designed protocol is essential.

Complying with Law No. 21,096 is not just a legal obligation but also an opportunity to strengthen customer trust and safeguard the company’s reputation. If your organization requires support navigating these requirements, feel free to contact us.

Link to the news: https://www.trendtic.cl/2024/12/nueva-ley-de-proteccion-de-datos-en-chile-esta-tu-empresa-preparada/