Chile’s 2025 cybersecurity and data laws: a guide for businesses

Executive summary

Chile has put in place a robust new regulatory framework with Cybersecurity Law No. 21,663 and Personal Data Protection Law No. 21,719. These laws, with implementation deadlines running until 2026, require Chilean companies, especially in sectors such as retail, fintech, banking and healthcare, to proactively adapt their risk management, regulatory compliance and digitization strategies.

Key points:

• Cybersecurity (Law 21,663): Requires organizations to implement information security management systems (ISMS), appoint a chief information security officer (CISO) and report incidents to the new National Cybersecurity Agency (ANCI) within strict deadlines. Penalties for non-compliance are significant, especially for operators of vital importance (OIV).
• Data protection (Law 21,719): Modernizes privacy, aligning with the GDPR. It strengthens ARCO+P rights, sets strict principles for data processing (lawfulness, purpose, consent) and provides for a data protection officer (DPO). Fines can reach up to 4% of annual global revenue.
• Strategic impact: Beyond compliance, these laws are a catalyst for technological innovation, stronger customer trust and the adoption of a culture of agile leadership and security. Managing first-party data becomes crucial as third-party cookies disappear.
• Next steps: Companies should run an assessment (gap analysis), set up proper governance, invest in technology and training, and consider expert advice to navigate this complex landscape.

This article takes a closer look at these regulations, their implications and how Soho can help organizations turn these challenges into competitive advantages.

The digital transformation imperative and Chile’s new regulatory mandate: adaptation and compliance

Chile is at a digital turning point. The recent enactment of Framework Cybersecurity Law No. 21,663 and Personal Data Protection Law No. 21,719 aren’t simple legislative updates; they represent a fundamental change in how organizations must operate, protect their information and relate to their customers. For decision-makers in key sectors such as retail, fintech, finance, banking, healthcare and education, understanding and adapting to this new framework isn’t just an obligation, but a crucial strategic opportunity for digital transformation and business risk management.

This new regulatory environment, combined with the imminent disappearance of third-party cookies, demands a proactive response. Companies that navigate this transformation successfully will not only avoid penalties and reputational risk, but will also strengthen customer trust, ensure business continuity and unlock new avenues for sustainable growth. At Soho, we understand that this path requires an integrated vision, from secure development and privacy-centered UX design to the implementation of ethical artificial intelligence (AI) and data strategies, supported by robust cloud infrastructure and agile DevOps practices.

This article is an essential guide to unraveling the complexities of these new laws, identifying the challenges and, most importantly, capitalizing on the opportunities they present for your company’s digital future in Chile.

Digitization has stopped being an option and become the core of business strategy. In Chile, this progress has driven efficiency and technological innovation, but it has also expanded the attack surface for cyberthreats and raised consumers’ expectations about the privacy of their data.

Laws 21,663 and 21,719 are a direct response to this reality. Implementing them is vital to business continuity and competitiveness, laying the foundations for a safer, more trustworthy national digital infrastructure.

“Cybersecurity and data protection are no longer purely technical topics; they’re fundamental pillars of business strategy and customer trust in the digital age.”

Cybersecurity, defined as preserving the confidentiality, integrity and availability of data, is enshrined as a strategic pillar. At the same time, personal data protection stands as a fundamental right, demanding transparent, responsible handling of individuals’ information.

For business leaders, this means going beyond mere regulatory compliance. It’s about fostering a culture of security and privacy, investing in technology and tech talent, and seeing these regulations as a catalyst for innovation and for building stronger, more trustworthy relationships with customers. The alignment with international standards such as the European GDPR, which these laws promote, also positions Chilean companies as more reliable partners in global digital trade.

WEF: Explainer: What is digital trust in the intelligent age?

Framework Cybersecurity Law (No. 21,663): strengthening digital resilience and risk management in Chile

Published on April 8, 2024, with general entry into force on January 1, 2025 (and specific articles from March 1, 2025), the Framework Cybersecurity Law marks a before and after for digital security in Chile. Its goal is clear: to ensure the confidentiality, integrity and availability of data and computer systems nationwide.

Key obligations for organizations under Law 21,663:

The law places direct responsibilities on companies, from prevention to response:

1. Information security management systems (ISMS):

   • Mandatory implementation, ideally aligned with ISO/IEC 27001.
   • Involves: identifying assets, assessing risks, implementing controls and clear policies.
   • A DevSecOps approach is crucial to build in security from the design stage (security by design).

2. Chief information security officer (CISO):

   • Appointment required.
   • Responsible for overseeing the cybersecurity strategy and ensuring compliance.
   • Must have authority and technical competence.

3. Risk assessment and business continuity:

   • Regular risk assessments.
   • Business continuity and disaster recovery plans (BCP/DRP).
   • Cloud solutions offer robust tools for resilience.

4. Ongoing training for tech talent and all staff:

   • The human factor is critical.
   • Constant training in cybersecurity best practices.
   • Programs tailored to each role, plus drills.

Operators of vital importance (OIV): a special focus and higher demands

The law pays particular attention to operators of vital importance (OIV), entities that provide essential services. These include sectors such as:

• Energy
• Telecommunications
• Transportation
• Financial services (banking, payment methods)
• Healthcare (hospitals, clinics)
• Digital infrastructure

The National Cybersecurity Agency (ANCI) is responsible for designating OIVs. These organizations face more rigorous duties.

“For OIVs, complying with Law 21,663 isn’t optional; it’s an imperative for national security and the continuity of essential services.”

Incident reporting: critical deadlines and the ANCI

The system for reporting incidents to the National CSIRT (under the ANCI) is a key transformation:

• Early warning: Within 3 hours of detection.
• Second report: Within 72 hours (or 24 hours if essential services are affected).
• Action plan: Within 7 days.
• Final report: Within 15 days.

These deadlines require advanced detection and response capabilities (SIEM, EDR) and efficient incident management.

The National Cybersecurity Agency (ANCI): the new authority for Chilean cybersecurity

Operating since January 1, 2025, the ANCI is a decentralized public agency with broad functions: to oversee, regulate, sanction and promote a culture of cybersecurity.

Penalties for non-compliance with Law 21,663:

Non-compliance can have severe consequences:

• Minor infractions: Up to 5,000 UTM (UTM is Chile’s monthly tax unit).
• Serious infractions: Up to 10,000 UTM.
• Very serious infractions: Up to 20,000 UTM.
• For OIVs, these fines can be doubled (up to 40,000 UTM).

Beyond the financial side, the reputational impact and operational restrictions are considerable.

Soho can help you navigate Law 21,663 by assessing your cybersecurity maturity, designing and implementing an ISMS, defining the CISO role, hardening your cloud infrastructure and adopting DevSecOps practices for a secure development lifecycle. Contact us.

Personal Data Protection Law (No. 21,719): toward a global standard for privacy and data governance

Law 21,719, published on December 13, 2024 (with an adaptation period until December 2026), drastically modernizes the old Law 19,628, aligning Chile with standards such as the European GDPR. Its goal is to regulate the processing of personal data, guaranteeing individuals’ rights and freedoms and fostering solid data governance.

Fundamental principles of data processing under Law 21,719:

All data processing must follow key principles:

1. Lawfulness: A clear legal basis (consent, contract, etc.).
2. Specific purpose: Specific, legitimate and disclosed purposes.
3. Proportionality: Only the data needed (data minimization).
4. Transparency: Clear information for data subjects. Transparent UX design is crucial.
5. Security: Appropriate technical and organizational measures. Robust cybersecurity is a prerequisite.
6. Confidentiality: Access only for authorized personnel.

Consent must be freely given, specific, informed and unambiguous. The law emphasizes privacy by default and by design.

Strengthened ARCO+P rights for data subjects:

Data subjects see their rights reinforced: access, rectification, erasure (cancellation), objection and portability.

“Law 21,719 empowers Chilean citizens, giving them unprecedented control over their personal data and demanding greater accountability from companies.”

The strategic role of the data protection officer (DPO):

The law introduces the role of the DPO (data protection officer). Although not always mandatory, it’s highly recommended for companies that process large volumes of data or sensitive data.

Data breach notification and the new Data Protection Agency:

The law establishes the obligation to notify personal data security breaches to the new Data Protection Agency and, in certain cases, to those affected. This agency will have oversight and sanctioning powers.

Penalties for non-compliance with Law 21,719:

The fines are significant:

• Minor infractions: Up to 500 UTM.
• Serious infractions: Up to 5,000 UTM.
• Very serious infractions: Up to 20,000 UTM or up to 4% of the business group’s annual global revenue.

Soho supports you in adapting to Law 21,719 by defining data governance strategies, designing privacy-respecting user experiences (UX), implementing secure, compliant data platforms and developing AI solutions that use data ethically and legally.

The critical convergence: cybersecurity, data protection and the future of digital marketing with first-party data

It’s essential to understand that Law 21,663 (cybersecurity) and Law 21,719 (data protection) don’t operate in silos. Robust cybersecurity is the indispensable foundation for guaranteeing personal data protection.

This convergence becomes even more critical when you consider digital marketing’s evolution toward a future without third-party cookies. First-party data, collected directly from users with their consent, becomes the most valuable asset.

The ethical, legal collection, management and activation of this first-party data, regulated by Law 21,719, will be a competitive differentiator. This requires:

• Unified data strategies with privacy built in from the source.
• Absolute transparency in how data is collected and used.
• The right technologies (CDPs, data lakes in the cloud).
• Analytics capabilities and responsible AI to extract value.

Beyond compliance: turning regulatory challenges into strategic opportunities with agile leadership

While regulatory compliance is the first step, the real opportunity for Chilean leaders lies in seeing these laws as an engine for positive transformation and the adoption of agile leadership:

1. Build stronger trust: Showing commitment to security and privacy earns loyalty.
2. Ensure operational resilience: Protect the company from costly disruptions.
3. Gain a competitive advantage: Attract investment and innovate responsibly.
4. Drive responsible innovation: Develop new products and services with privacy “by design.”

The role of technology, automation and specialized expertise:

Adapting to this new paradigm requires a combination of strategy, processes, automation and technology. This is where the experience of a partner like Soho becomes crucial:

• Secure development (DevSecOps): Security built into the software lifecycle.
• Privacy-centered UX design: Intuitive, transparent interfaces.
• Ethical AI and data: AI solutions that respect privacy.
• Secure cloud solutions: Agility and scalability with robust security.
• DevOps practices and automation: Improve your security posture and speed up response.

Roadmap to adaptation: practical steps for Chilean companies

Navigating this new landscape requires a clear plan. Consider the following steps:

1. Assessment and evaluation (gap analysis):

   • Assess your current position against both laws.
   • Identify gaps in policies, processes, technologies and training.
   • Classify information assets and assess risks.

2. Set up proper governance:

   • Define key roles: CISO and, where applicable, DPO.
   • Establish clear policies.
   • Involve senior management and foster a culture of security.

3. Investment in technology and processes:

   • Implement or update your ISMS.
   • Adopt security and automation tools.
   • Review processes for consent management, ARCO+P rights and incident reporting.

4. Training and awareness for tech talent and all staff:

   • Develop ongoing training programs.
   • Run drills.

5. Review of contracts and third parties:

   • Make sure your suppliers comply.

6. Incident response plan:

   • Develop and test your response plan.

7. Seek expert advice:

   • An experienced partner can speed up your adaptation.

The future is now for Chilean companies – technological innovation and compliance

The cybersecurity and personal data protection laws mark the start of a new era for companies in Chile. Far from being a burden, they’re an opportunity to grow stronger, foster technological innovation and build a safer, more trustworthy digital future. Proactive adaptation, smart investment and choosing the right technology partners will be decisive for success.

At Soho, we’re ready to accompany you on this journey, helping you turn regulatory challenges into solid foundations for your growth and leadership in Chile’s digital economy.

Is your company prepared for this new landscape?

Navigating the complex environment of Chile’s new cybersecurity and data protection laws requires specialized knowledge and a clear strategy.

• Contact our experts: For a personalized assessment of your current situation and a roadmap tailored to your needs.
• Discover our solutions: Explore how our capabilities in development, UX design, AI, data, cloud and DevOps can strengthen your company.