Chile's Law 21.719: What Changes December 1 for Plants

Law 21.719: Chile's New Data Protection Framework and Your Industrial Plant #

On December 13, 2024, Chile published Law 21.719 in its Official Gazette, completely overhauling the personal data protection regime of the old Law 19.628 from 1999. It takes effect on December 1, 2026 (a bill in the Senate, bulletin 18.623-07, would postpone it by a year, but it had not been voted on as of late September 2026). It aligns Chile with the European GDPR standard and is the deepest regulatory change Chilean industrial plants have faced on privacy and cybersecurity in decades.

If you're a plant manager, operations director or IT lead at a manufacturing, mining, food or logistics company in Chile, this law affects you directly. Video surveillance cameras, IoT sensors, biometric access control systems and even the operator productivity records you capture today fall under a new, strict enforcement regime. Ignoring it isn't an option: the penalties can bring your operation to a halt.

Why Does a Personal Data Law Affect a Factory?

There's a mistaken perception that data protection is only a matter for banks, retailers or tech companies. Nothing could be further from the truth. A modern industrial plant captures personal data massively and continuously: video surveillance of operators on production lines, access logs using fingerprints or facial recognition, geolocation of in-plant fleet vehicles driven by workers, individual productivity monitoring through sensors at workstations, and even occupational health data captured by safety wearables. All of this data is now protected by Law 21.719.

The Five Critical Changes for Industrial Plants #

1. Explicit, Informed Consent

The law recognizes five legal bases for processing personal data: free, specific and informed consent, performance of a contract, a legal obligation, legitimate interest weighed against the data subject's rights, and the defense of rights. The employment contract covers part of what a plant records, but not all of it: in every case, operators must be told precisely what data is captured (video, audio, biometrics, location), for what purpose, how long it is stored and who has access. The tacit or generic consent many companies used to include in employment contracts is no longer enough. The Personal Data Protection Agency, created by this same law, will check that the basis for each processing activity is documented.

2. Video Surveillance and IoT Sensor Data

Security cameras on production lines, loading yards and entrances capture images of workers continuously. Under Law 21.719, these recordings are processing of personal data and must follow the principles of purpose limitation, proportionality and data minimization. You can't simply store video indefinitely "just in case." You have to define retention periods and strict access controls, and make sure the images aren't accessible to unauthorized staff. The same applies to IoT sensors that record movement patterns or human presence in production areas.

3. Biometric Data as a Sensitive Category

The law raises biometric data (fingerprints, facial recognition, hand geometry) to the category of sensitive data, giving it reinforced protection. This directly affects plants that use fingerprint readers for access to restricted areas or biometric time clocks to record working hours. Processing sensitive data is prohibited by default unless there is a specific legal authorization or the data subject's explicit consent.

4. Mandatory Breach Notification

In the event of a security breach affecting personal data that creates a reasonable risk, the data controller must notify the Agency by the fastest means possible and without undue delay. The law doesn't set a number of hours (the frequently quoted 72 come from the European regulation and are worth adopting as an internal target), and affected individuals must be notified when the breach involves sensitive data, data about minors or financial obligations. This applies even if the attack was ransomware that encrypted video surveillance servers or an unauthorized third party who accessed your plant's access control database. Failing to notify on time is a serious infraction with its own fines, separate from the original incident.

5. ARCO Rights (Access, Rectification, Cancellation, Objection)

Your operators and contractors now have the right to request access to all the personal data your plant stores about them, demand its correction if it's wrong, request its deletion when it's no longer needed, and object to certain processing. Your operation must have documented procedures to respond to these requests within the legal deadlines.

The Real Risk: Fines of Up to CLP 1.3 Billion #

Law 21.719 establishes a sanctions regime that didn't exist in previous Chilean law. The new Personal Data Protection Agency can impose fines of up to 20,000 UTM (UTM is Chile's inflation-indexed monthly tax unit), more than CLP 1.3 billion, for the most serious infractions; for a large company that reoffends, it can reach 4% of annual revenue. The sanctions fall into three levels:

• Minor infractions: a warning or a fine of up to 5,000 UTM (~CLP 325 million)
• Serious infractions: a fine of up to 10,000 UTM (~CLP 650 million)
• Very serious infractions: a fine of up to 20,000 UTM (~CLP 1.3 billion), and the Agency may also order a temporary suspension of the data processing

To put it in industrial perspective: a very serious infraction detected by the Agency (for example, a massive leak of your plant's surveillance footage to the internet due to a lack of security measures) could cost your company more than an entire production line. And unlike previous bodies, which had no real power, the Agency has robust inspection, rule-making and sanctioning powers, including the ability to carry out on-site audits at your facilities.

The Cloud Trap: Why AWS, Azure and Google Cloud Increase Your Risk #

Faced with Law 21.719, many Chilean industrial plants are making a strategic mistake: moving their monitoring, video surveillance and data management systems to cloud platforms such as AWS, Microsoft Azure or Google Cloud. The logic sounds reasonable: "if my data sits on certified, secure servers, I'm covered." That conclusion is wrong and dangerous.

The problem is international data transfer. Law 21.719, following the European GDPR model, provides that personal data may only be transferred to countries that offer an adequate level of protection, as determined by the Agency. When the surveillance footage from your plant in Santiago or Antofagasta is stored on AWS servers in Virginia (US), Azure in Dublin (Ireland) or Google Cloud in São Paulo (Brazil), you are making an international transfer that requires strict additional safeguards, such as standard contractual clauses, binding corporate rules or certifications approved by the Agency.

Worse still: many cloud services automatically replicate data across regions for high availability. Without realizing it, images of your operators may be hosted simultaneously on servers on three different continents, each under a different legal jurisdiction and potentially accessible to foreign authorities (such as under the US CLOUD Act, which lets the US government request data held by American companies even when it's stored outside US territory).

Edge computing is the technical and legal answer to this problem. Processing data where it's generated, inside your plant's physical boundaries, removes the international transfer at the root, keeps the data under Chilean jurisdiction and greatly simplifies your regulatory obligations.

Where iGromi Fits In (and Where It Doesn't) #

No software makes a plant meet the requirements of Law 21.719: that depends on the legal basis for each processing activity, the notices to workers, the retention periods and the procedures the company defines. What an architecture does change is how much personal data leaves the plant.

Video Processed in the Plant

The iGromi Edge is installed in the plant and processes the existing cameras right there. From each image it extracts the event that matters (a unit counted, a stop, a headcount in a zone) without the raw video having to travel to the cloud to get it.

What Does Leave, and Why

Events, not images, feed the KPIs. When someone asks the AI a question, the plant's context and memory stay in the iGromi engine; the model receives the question with what it needs to answer it. Saying "nothing leaves the plant" would be false, and that's exactly the kind of claim you should ask any vendor to put in writing.

Readiness Checklist for Plant Managers #

If you're reading this from an industrial plant in Chile, here's an immediate checklist of actions to get ready before the Agency starts active inspections:

1. Personal data mapping: Identify every personal data flow in your plant: surveillance cameras, IoT sensors that capture human presence, biometric access systems, per-operator productivity records, in-plant fleet GPS, safety wearables. Document where each originates, where it's stored and who has access.
2. Legal basis for processing: Check that each processing activity has a clear legal basis (consent, legal obligation, legitimate interest). Update your privacy notices and obtain explicit consent where needed.
3. International transfer assessment: If you use cloud services (AWS, Azure, Google Cloud, OVH, etc.), find out exactly which jurisdictions your data is stored in and whether that transfer meets the safeguards the law requires.
4. Retention policies: Define and document maximum storage periods for each category of personal data. Put automatic deletion or anonymization in place when those periods expire.
5. Breach response plan: Set up a documented procedure to detect, contain, assess and report any security breach to the Agency without undue delay; set 72 hours as an internal target.
6. ARCO rights procedure: Design and communicate accessible channels for data subjects to exercise their rights of access, rectification, cancellation and objection. Assign internal owners with defined response times.
7. Edge-first infrastructure: Consider moving the processing and storage of sensitive data to a local Edge Computing architecture that keeps data sovereignty inside your plant, removing international transfer risks and greatly simplifying your obligations.

Conclusion: Regulatory Readiness as a Competitive Advantage #

Law 21.719 isn't just another bureaucratic burden; it's an opportunity for Chilean industrial plants to review their data architecture and cut down how much personal data they move around unnecessarily. Companies that act now (mapping their data, setting retention periods and processing in the plant whatever doesn't need to leave) will not only reduce their exposure to fines but build a competitive edge in trust and operational resilience over competitors that keep relying on cloud infrastructure with unresolved legal risks.

The Data Protection Agency will begin operating with full powers on December 1, 2026. The time to prepare your plant is now, before an inspector knocks on your door.

If you're also going to use AI with that data, review the six criteria for safe industrial AI: where the model runs, what data leaves the plant and who confirms before anything acts on a machine. More context in the guide to industrial artificial intelligence.