ChatGPT With Plant Data: What Chile's Law 21.719 Allows

Yes, a plant can use ChatGPT, DeepSeek or another AI model with its information, and Chile's Personal Data Protection Law (Law 21.719) does not prohibit it. The law looks at two things: whether what is sent contains personal data and where it goes. An oven's temperatures, a line's OEE or a compressor's failure history are not personal data. The operator's name on the shift report, line video showing workers or the fingerprint from the time clock are.

The law takes effect on December 1, 2026. What follows does not replace a lawyer; it helps you know what to ask one.

Which plant data is personal data? #

Data that identifies a person or allows a person to be identified. In a plant it is mixed with process data more than it seems:

Data	Personal?	Why
A machine's temperature, pressure, speed	No	It describes equipment, not a person
Units produced, OEE, stops per line	No	As long as they are not linked to a worker
An equipment manual, a cleaning procedure	No	Unless it includes names or signatures
Shift report with the operator's name or RUT (Chilean national ID number)	Yes	It identifies who worked and how much they produced
Productivity or errors per operator	Yes	It is information about a person's performance
Line video in which workers appear	Yes	The image identifies the person
Fingerprint or face from the time clock	Yes, sensitive	The law treats biometric data as sensitive

Most of what a manager wants to ask an AI (why performance dropped, what the manual says, how long the line was stopped) can be answered with the data in the first rows.

What happens when someone pastes a shift report into ChatGPT? #

If the report includes names, the company is processing personal data and, since the model's servers are outside Chile, it is also transferring that data abroad. The law allows such a transfer when the destination country has an adequate level of protection or when there are contractual safeguards, and it requires the processing to have a legal basis: consent, contract, legal obligation, legitimate interest or defense of rights.

The practical problem is not the model but the account. Free and personal versions of the assistants may use conversations for training, depending on each user's settings. Business accounts and API access from the main providers state that they do not train on customer data and offer a data processing agreement. With a personal account, the company neither controls nor knows what was sent.

Is DeepSeek safe to use at work? #

You have to separate the model from the service. DeepSeek's app and API store data on servers in China, according to its own privacy policy; that is why several European regulators restricted it in 2025. The model, on the other hand, is open: other providers offer it from their own servers under no-retention agreements, and it can also run on a company server with tools such as Ollama. Same model, very different risk.

At iGromi we do not use DeepSeek's direct API for that reason.

Three rules for using AI in the plant without exposing yourself #

Separate process data from personal data. Before sending a report or a record, replace the operator's name with a shift or station code. The question "why did line 2's performance drop?" almost never needs to know who was there.
Use business accounts, not personal ones. A business account or an API under contract puts in writing that the provider does not train on your data and how long it keeps it. Without that, you have no way to answer Chile's Data Protection Agency.
Decide what never leaves. Video with workers and biometric data are processed in the plant. If AI is needed on them, use a model running on your own server.

A fourth one, which is not technical: have a short written AI use policy, listing which tools are allowed and which data must never be pasted into them. Most incidents with these assistants start with a well-meaning person using their personal account. The spreadsheet in this article classifies plant data, evaluates each tool in use and drafts that policy on one page.

How does iGromi handle it? #

At iGromi, the plant's context and memory (manuals, failure history, what each line produced) stay in the iGromi engine, not with the model provider. The model receives the question with the passages needed to answer it, and camera video is processed on the Edge installed in the plant. We do not say that "nothing leaves the plant", because the question does leave: what we decide is what goes with it.

That is the foundation of the industrial Second Brain. If you want to review which of your plant's data can go into an AI and which cannot, let's talk.

Frequently asked questions #

Is it illegal to use ChatGPT in my company in Chile?

No. Law 21.719 does not regulate tools; it regulates the processing of personal data. Using ChatGPT with process data does not touch it. Using it with data about people requires a legal basis and safeguards for the transfer abroad.

Do I need workers' consent to use AI?

It depends on the basis for the processing. Part of what a plant records about its workers rests on the employment contract or on legal obligations; other uses, such as analyzing their performance with AI, may require consent or a legitimate interest assessment. That is the specific question for your lawyer.

What fines does Law 21.719 provide for?

Up to 5,000 UTM (Unidades Tributarias Mensuales, a Chilean monthly tax unit) for minor infringements, 10,000 for serious ones and 20,000 for very serious ones. For large companies that reoffend, up to 2 % or 4 % of their annual revenue. The details for plants are in what changes in your plant on December 1.

Will Law 21.719 be postponed?

There is a bill in the Senate (bulletin 18.623-07) that proposes moving it to December 1, 2027. As of late September 2026 it had not been voted on, so the legal date is still December 1, 2026.