Law 21.719: what it is and what changes for your eCommerce

If you run an eCommerce or do digital marketing, you work with personal data every day: your newsletter emails, contact forms, the audiences you upload to your campaigns. That is why you should have Law No. 21.719 on your radar — Chile's new personal data protection regulation, which comes into force on 1 December 2026.

This is not just "a lawyers' topic". It changes how you can collect and use your customers' data, and that directly affects how you segment, how you capture leads and how you build your campaigns. Here it is in plain terms.

What Law 21.719 is

Law 21.719 replaces the old Law 19.628 on the Protection of Private Life, which had been in force for more than two decades. The new regulation modernises the rules, creates a Personal Data Protection Agency with supervisory powers, and brings Chile in line with international standards such as the European GDPR. You can read the official text at the Library of the National Congress of Chile.

The underlying idea: personal data is treated as a right of the individual, and any company using it takes on clear obligations about how it is requested, stored and protected.

The changes that affect marketing and eCommerce most

1. Explicit consent (this is the big one for you). Previously, silence could be read as permission. Under the new law, you need clear, specific and informed consent to use someone's data. In practice: if you are going to use an email address for a campaign, you must have asked for it explicitly for that purpose — and be able to prove that you asked. Pre-ticked boxes and "generic permissions" no longer work.

2. From reacting to preventing. The law focuses on proactive accountability: it is not enough to fix things when they go wrong, you have to manage data properly from the start. The good news is that having orderly processes can release you from liability if an incident ever occurs that was not down to your negligence.

3. More rights for individuals. Your customers will be able to ask to access their data, correct it, delete it or object to certain uses. If you do not respond, they can complain to the new Agency.

4. Chain of responsibility. If you share data with third parties (your agency, an email platform, a CRM), you are also answerable for how they handle it. That is why it pays to work only with providers who meet the same standard.

How much the fines cost

Penalties are set at three levels:

• Minor: up to 5,000 UTM.
• Serious: up to 10,000 UTM.
• Very serious: up to 20,000 UTM (for example, unlawful processing of sensitive data).

For reference, 1 UTM is around CLP $70,000 (a value updated monthly), and in the event of a repeat offence the fine can be multiplied by up to three. It is not a small matter.

What to do in your business before December

A simple roadmap to get there in time:

• Audit your data: identify what data you hold, where it came from, where it is stored and who has access. Spot "orphan" databases or those without clear permission.
• Update your privacy policy: in plain language, easy to find, explaining what you use the data for and for how long.
• Review your forms and checkout: make sure marketing consent is explicit and separate, not tangled up with another authorisation.
• Review contracts with providers and agencies: include data protection clauses with anyone processing information on your behalf.
• Consider a data protection officer (DPO): depending on the volume and sensitivity of what you handle.

Each of these points deserves more detail: if you want to know how to carry them out, we follow this roadmap in the step-by-step guide to making your eCommerce compliant with Law 21.719.

More than an obligation, an opportunity

Complying is not only about avoiding fines. Asking for data transparently and with purpose builds trust with your customers, and that trust also sells. The goal is unchanged — segment, measure and convert — it is just now done with permission and clarity.

At Clicomy we approach digital marketing with that logic. If you want to get your eCommerce data capture in order ahead of the new law, let's talk.

Sources and further reading: Law 21.719 and Law 19.628 (Library of the National Congress of Chile), GDPR (EU). General coverage of the topic in outlets such as La Tercera.