Data Subject Rights in Chile
Data Subject Rights in Chile under Law 21719 are legal prerogatives that allow individuals to control the use of their personal data. These rights include access, rectification, erasure (deletion), objection, restriction (blocking), and data portability. For companies, properly managing Data Subject Rights in Chile is essential: it prevents sanctions and demonstrates transparency to clients.
Summary: Data Subject Rights in Chile allow any individual to understand and control how their data is used. Companies must provide clear channels (such as forms or email) and comply with strict deadlines (response within 30 days). This process must be free of charge and properly documented. It helps prevent fines and loss of trust. A checklist and practical examples for SMEs are included.
Rights recognized by Law
Law 21719 specifically recognizes the following Data Subject Rights in Chile:
-
- Access: Allows the data subject to request and obtain a copy of their personal data being processed.
- Rectification: The data subject may request the correction of inaccurate or outdated data.
- Erasure (Deletion): Grants the right to have personal data deleted when it is no longer necessary or when sensitive data is processed without proper authorization.
- Objection: Allows the data subject to object to the processing of their data for legitimate reasons, especially in direct marketing or automated decision-making.
- Restriction (Blocking): Enables the temporary suspension of processing while discrepancies are resolved (e.g., disputes regarding data accuracy).
- Portability: The data subject may request their data in a structured and readable format to transfer it to another controller.
These Data Subject Rights in Chile must be clearly included in the privacy policy and in any authorization forms. In addition, they are not mutually exclusive: a single data subject may exercise several of these rights simultaneously.
Exercising Data Subject Rights: procedure and deadlines
To exercise Data Subject Rights in Chile, the law establishes specific steps and deadlines:
-
- Submission of Request: The data subject must send a written request to the controller (email, web form, letter, etc.). There is no official mandatory form, so a simple internal format is recommended.
- Acknowledgment of Receipt: Upon receiving the request, the company must acknowledge receipt without delay, confirming that the request has been registered.
- Verification: The company must verify the identity of the requester to prevent fraud. This may involve documentation (e.g., national ID or equivalent credentials).
- Response within 30 days: The law requires a response within 30 calendar days. This period may be extended once for an additional 30 days if necessary.
- Response Format: The response must be clear and in writing (email or printed document). If the request is granted, the company must provide the requested information or confirmation of rectification or erasure. If denied in whole or in part, the reasons and available remedies must be explained.
- Free of Charge Process: All Data Subject Rights in Chile must be exercised free of charge. The company cannot impose fees for these procedures.
If the company fails to respond within the legal timeframe, the data subject may directly обратиться to the Data Protection Authority. This highlights the importance of complying with deadlines and formal procedures when handling Data Subject Rights in Chile.
Obligations of the controller and processor
The company —the data controller— has specific obligations regarding the exercise of Data Subject Rights in Chile:
- Enabled Channels: It must inform in its privacy policy and public documents how rights may be exercised. For example, through a contact email or a form on the website.
- Request Register: It must keep an internal record of each request received and its response, for internal audits and possible inspections.
- Coordination with the DPO: If there is a Data Protection Officer (DPO), the DPO supervises the process, trains staff, and verifies compliance. The DPO may also intervene in complex cases or mass requests.
- Integration with Compliance: The management of rights must be integrated into the company’s legal compliance plan. This includes assessing its management in periodic audits.
The data processor —third-party providers— must also cooperate when Data Subject Rights in Chile are exercised, providing the required information and following the controller’s instructions.
Practical examples and templates for SMEs
To facilitate implementation, specific actions are recommended:
-
- Design Simple Formats: Create rights request templates —online or on paper— that guide the data subject to provide the minimum necessary information.
- Update Internal Channels: Ensure that everyone in the company knows when to redirect a rights request, for example to the legal department or DPO.
- Prepare Standard Responses: Draft model responses for each right, such as an access letter listing the data processed or a refusal letter with the legal basis.
- Train The Team: Train responsible employees in the basic principles of these rights to avoid management errors.
- Record Everything: Keep an internal checklist for each request with key dates —receipt, response sent, closure.
Example of a simplified process:
-
- The client sends an email requesting access to their data.
- The person in charge verifies identity and records the request.
- Within 30 days, a PDF with the client’s data is sent —complying with the right of access— and the case is archived.
Rights in automated processes
The law also covers special situations:
-
- If the company carries out automated profiling or automated decision-making concerning individuals, the data subject has the right to obtain meaningful information about the logic applied. This is linked to technological transparency.
- In these cases, it is advisable to coordinate the response with the Data Protection Impact Assessment and the Data Protection Officer to ensure consistency.
Risks and sanctions for non-compliance
Ignoring Data Subject Rights in Chile may result in serious sanctions. The law provides fines that vary depending on the seriousness of the infringement (see fines section). In addition, failing to respond to requests may lead to formal claims before the Agency and damage the company’s reputation.
Implementing this process not only helps avoid sanctions, but also strengthens public trust in your business.
Implementation checklist for Data Subject Rights in Chile
-
- Define a clear Channel (Email or Form) for requests
- Create a Form or Guide to receive requests
- Train the person in charge (or DPO) in rights management
- Establish an internal record of all requests and responses
- Prepare response templates (Approval or Refusal)
- Inform in the Privacy Policy how and where rights may be exercised
- Periodically review compliance (possible internal audit)
Frequently Asked Questions about
Data Subject Rights in Chile
Who can exercise Data Subject Rights?
Any natural person who is the data subject (clients, employees, suppliers), acting directly or through a legal representative.
What is the deadline for the company to respond?
The company must respond within 30 calendar days, extendable once for an additional 30 days.
Is exercising Data Subject Rights free of charge?
Yes. Exercising all Data Subject Rights in Chile is free of charge.
What happens if requests are not answered?
The data subject may file a complaint before the Data Protection Authority if no response is received or if the refusal is unjustified.
How does data portability affect companies?
Data portability allows the data subject to request their data in a structured format to transfer it to another service, as established by law.
Protect your clients’ rights today
Comply with Law 21719 with expert support and tailored templates.
Our data protection specialists will help you implement Data Subject Rights in Chile in a simple and complete way.
Share it!
