Chile

Ley 19.628 governs the processing of personal data in registries or data banks by both public bodies and private parties, with an exception for processing carried out in the exercise of freedom of opinion and information.

Its Título V arms a data subject with a direct civil action: the controller, whether a private person or a public body, must compensate the patrimonial and moral damage caused by improper treatment of the data, and that damages claim may be brought together with the claim establishing the infraction itself, under summary civil procedure.

The statute remains the law in force in Chile as of this date; its substantive provisions are due to be superseded by Ley 21.719 on 1 December 2026, and several of its articles already carry pending-amendment banners on the primary source pointing to that commencement date.

Ley 21.719 replaces Ley 19.628 with a General Data Protection Regulation (GDPR)-influenced comprehensive regime covering both public and private-sector processing and amends Ley 20.285 (public information access) and Ley 19.496 (consumer protection) in the same act.

It was promulgated 25 November 2024 and published in the Diario Oficial 13 December 2024, but its own transitory provisions delay commencement of the substantive amendments to the twenty-fourth month after publication, which the primary source's own version banner confirms as 1 December 2026; the law is therefore enacted but not yet in force. It has already been amended once before taking effect, by Ley 21.806 (5 February 2026).

Ley 21.719 establishes the Agencia de Protección de Datos Personales (APDP) as data-protection regulator, with an administrative-sanction procedure for infractions classified as leve, grave, or gravísima, escalating fines by tier, and a further judicial review of Agency decisions before the Corte de Apelaciones. Persons affected by a decision of a public body handling their data under this law may also bring a claim before the Corte de Apelaciones under the same procedure. As with the rest of Ley 21.719, this enforcement structure is enacted but not yet in force.

Article 2 criminalizes accessing a computer system without authorization, or exceeding held authorization, only where the actor also defeats a technical barrier or technological security measure protecting that system.

Both elements are conjunctive on the statute's own text, so crawling a page that carries no such barrier, a public, unauthenticated page, does not by itself satisfy this offence; accessing a system behind a login, a paywall, or another technical access control without authorization does.

The offence carries presidio menor en su grado mínimo (a short custodial term) or a fine of eleven to twenty unidades tributarias mensuales, rising where the access is committed with intent to appropriate or use the system's information (art. 2, second paragraph, not quoted here). This statute repealed and replaced Ley 19.223 to align Chile with the Budapest Convention on Cybercrime.