Privacy and the right to be forgotten: your rights over your data

You have concrete rights over your personal data, even when another company holds it. Ley 21.719, published in December 2024 and in force in…

2026-05-29 · AI and data compliance

You have concrete rights over your personal data, even when another company holds it. Ley 21.719, published in December 2024 and fully in force from 1 December 2026, changes the rules of the game in Chile: more rights for individuals, more obligations for whoever processes that data, and an Agency that can impose fines. If you want to know what you can ask for and how, this is for you.

Your data is yours (even when another company holds it)

Every time you register on a platform, buy online, use an app or browse, you produce personal data. The fact that a company stores it does not extinguish your relationship with that information. The regulatory framework both in Chile and in the global trend starts from a basic premise: the individual retains rights over their data, even when the data controller is a third party.

This means you are not merely the subject of a service contract: you are also the holder of a set of rights you can actively exercise. Knowing them is the first step.

The ARCO rights: access, rectification, cancellation and objection

The international standard recognises four central rights, which Ley 21.719 incorporates and extends:

Access: you can ask any organisation to tell you what data of yours it holds, where it obtained it, what it uses it for and to whom it has transferred it.
Rectification: if your data is incorrect, incomplete or out of date, you have the right to demand that it be corrected.
Cancellation or erasure: in certain circumstances, you can ask for it to be deleted: when it is no longer necessary for the purpose for which it was collected, when you withdraw your consent, or when the processing is unlawful.
Objection: you can refuse certain uses of your data, particularly when the processing rests on the controller's legitimate interest or is aimed at direct marketing.

Ley 21.719 adds further rights, such as portability (receiving your data in a readable format so you can take it to another provider) and the right not to be subject to solely automated decisions that significantly affect you.

The "right to be forgotten": what it is and what it is not

The so-called "right to be forgotten" is, technically, a form of the right to erasure. It became well known in Europe after the Court of Justice of the EU ruling in the Google Spain case (2014), which ordered Google to remove from its results a link about a Spanish citizen's already settled debt. The underlying idea: information that was legitimate at the time can become inadequate or irrelevant over time.

It is not an absolute right. It has clear limits:

It does not apply where the processing is necessary for the exercise of freedom of information and of the press.
It does not erase the record where the data is required by legal obligation (for example, accounting or tax records).
It does not delete information of public interest or historical relevance.

But it can apply, for example, when a company keeps using your contact details for commercial purposes even though you have not been a customer for years, or when a platform keeps published content that no longer reflects your current situation.

What changes with Ley 21.719 in Chile

Ley 21.719 was published in the Diario Oficial on 13 December 2024 and will fully replace the old Ley 19.628 when it comes into full force on 1 December 2026. The most relevant changes are:

Personal Data Protection Agency (APDP): created as an autonomous body with power to investigate, sanction and publish a register of infringements. Until now there was no specific entity for this in Chile.
Stronger sanctions: fines can reach 20.000 UTM for a serious infringement, and up to 4% of the controller's annual revenue in cases of serious repeat offending. This brings Chile into line with the European GDPR in terms of deterrent force.
Mandatory breach notification: if a company suffers a leak that could affect you, it must notify you and also the APDP within defined deadlines.
Explicit legal basis: it is no longer enough for the data to be "available": the company needs a concrete legal basis (your consent, a contract, a legal obligation or a duly justified legitimate interest) to process your data.

A concrete example: the sign-up on an app you no longer use

Imagine that three years ago you registered on a delivery app you later stopped using. The app still has your name, email, phone number and address. Under Ley 21.719, you have the right to write to them asking for your data to be deleted. They have a deadline to reply, they must demonstrate whether any legal reason exists to retain it (for example, if you have unpaid invoices), and if not, they are obliged to erase the information. If they do not, you can complain to the APDP.

For companies: there is time, but it is best not to wait

The transition period until December 2026 is not free time: it is time to adapt. Organisations must review what data they hold, on what legal basis they process it, what privacy policies apply and how they respond to data subject requests. Preparing now is cheaper than adapting under pressure with the APDP already operating.

What you can do today

Ask the companies you deal with what data they hold about you and what they use it for.
Check what you accept before handing over your data: informed consent matters.
Exercise your rights: if you want out-of-date data deleted, you have a legal basis to ask.
If you run a company: start reviewing your data processing. The APDP will be active in December 2026.

In summary

Ley 21.719 strengthens your rights over your personal data —access, rectification, erasure, portability, objection— and creates an Agency with teeth to enforce those rules. The "right to be forgotten" is not magic: it has limits, but it is a real tool for asking that your information stop following you when there is no longer any sense in it being there. For individuals, it is worth knowing. For companies, it is worth preparing before the law comes fully into force.

Source: Ley 21.719 — Biblioteca del Congreso Nacional de Chile. Informational content: it does not replace professional advice.

— Mindset & Code · Legal-Tech Chile · law and technology, explained simply.