Chile's Law 21.719 · in effect December 1, 2026
Your plant already processes biometric data. Probably without having assessed it.
The floor cameras, the fingerprint clock at the entrance and the access control to the electrical room process the most sensitive data category of the new law. Not because anyone decided so, but because they capture features that identify a person.
Cases
Where biometrics shows up in a plant
Four cases that almost no operation has documented in its record of processing activities.
Cameras on the plant floor
Fingerprint time clocks
Access control to restricted areas
PPE detection with computer vision
Comparison
What changes depending on where processing runs
The obligation is the same in both cases. What changes is how much surface is exposed.
International data transfer
Processing in the cloud
Processing at the edge
Data processor
Processing in the cloud
Processing at the edge
Notify breaches without undue delay
Processing in the cloud
Processing at the edge
Data minimization
Processing in the cloud
Processing at the edge
| What the law requires | Processing in the cloud | Processing at the edge |
|---|---|---|
| International data transfer | Data travels to servers outside Chile. There is a transfer and it must be justified with safeguards. | There is no transfer: the data does not cross the plant boundary. |
| Data processor | The cloud provider becomes a processor, with a contract and the associated liability. | There is no third party: processing happens on hardware the customer already controls. |
| Notify breaches without undue delay | Wide surface: transit, storage, provider access and APIs. | Minimal surface. What does not leave the plant does not leak in transit. |
| Data minimization | Raw video is usually uploaded and filtered later, "just in case". | The fact is inferred and the image discarded. The event remains, not the face. |
Example
The case that explains it best
A camera sees an operator enter a restricted area. Inference happens at the edge and what is stored is the fact (“unauthorized access, line 3, 14:22”), not the image of the face. The biometric data existed for milliseconds in memory and was never persisted.
There is nothing to leak, transfer or notify. And that does not depend on someone remembering a policy: it follows from where the compute runs.
This is not legal advice
Processing locally reduces the exposure surface, but it does not replace the data controller’s obligations: informing, recording activities, assessing impact where applicable and having a lawful basis. Before December 1, 2026 it is wise to review your operation’s specific case with a lawyer. The official text is at Chile's Library of the National Congress (BCN).
Where data lives
Cameras, in the plant. The rest, wherever you decide.
iGromi cloud, separated per company
The shift app: chat, photo and voice records, and AI that answers with its source.
A private, isolated cloud for your company
Adds SAP, ERP and spreadsheets. The AI model runs inside that cloud.
Inside your plant, on Edge or on-premise
Adds PLCs, sensors and cameras. The Edge reads the PLC read-only and keeps measuring offline.
How it looks in the app
The shift is recorded in the app, without biometrics.
The free app records who did what with their user account, a photo of the task and the time. It uses no fingerprints or facial recognition.
- Records with author and time, in your company’s cloud.
- AI cameras run in the plant (Enterprise).
- The AI proposes; a person decides.
Free app in early access. Web available; Android and iOS coming soon.
FAQ
Frequently asked questions
Does a plant camera process biometric data?
Since when does Chile's Law 21.719 apply?
Is a fingerprint time clock covered by the law?
Does edge processing remove the legal obligation?
Every shift without a record is data you lose. Start free.
- 1Request early access, free
- 2Pick your trade: maintenance, production or safety
- 3Your team starts with the chat and its trade helper
No credit card. Your data stays yours.