Law 21.719 prepares your website for fines

Your site could be collecting personal data without you noticing. Forms, cookies, analytics tools and external providers: find out what you should review before you expose yourself to legal problems.

Does your website collect names, emails or phone numbers from your clients? Do you use Google Analytics, contact forms or advertising tools? Do you know where that information is stored and who can access it?

If you do not have clear answers to these questions, you may have a problem you have not yet detected.

Law 21.719 changes the rules on how organizations collect, use and protect personal data in Chile. Although it is often discussed in relation to large companies and digital platforms, it can also affect small businesses, online stores and websites that receive information from their visitors.

The problem is that many pages are built with selling, attracting clients or generating traffic in mind, but we rarely stop to review what happens to the information people leave on them.

And that is precisely what you should start looking at.

What changes with Law 21.719?

Law 21.719 modernizes the Chilean regulation on personal data protection, amends Law 19.628 and creates the Personal Data Protection Agency.

Among other things, it sets new requirements for processing personal information, strengthens people’s rights and establishes a regime of infractions and sanctions.

The law was published in December 2024 and its entry into force is scheduled for December 1, 2026. A bill submitted to the Senate in September 2026 proposes postponing it until 2027; until it is approved, the effective date remains 2026. Check the status of Bulletin 18.623-07 in the Senate and in the National Congress Library (bcn.cl).

This means that a generic privacy policy or a cookie notice is no longer enough. Organizations must be able to explain what information they collect, what they use it for, how they protect it and under what conditions they share it.

And what does this have to do with your website? Practically everything that happens when someone interacts with it can involve personal data.

When could your website be at risk?

You do not need a complex platform to run into these problems. A few fairly common features are enough.

01. Contact forms

Are you asking for more information than you really need?

Name, email, phone and company are data that many pages request without clearly explaining what they will be used for.

Review what information you are collecting, what its purpose is and how you inform people about its processing. You should also consider how you handle requests from people who want to exercise their rights.

02. Cookies and tracking tools

Do you know what is happening while people browse your site?

Google Analytics, Meta Pixel and other tools can collect information about your visitors’ behavior. They may also involve external services that receive or process data.

It is not simply a matter of installing a banner that says “accept cookies”. You need to identify which tools you use, what information they collect and how you manage consent when it applies.

03. Privacy policy

Does your site really explain what you do with your users’ information?

Many websites have privacy policies copied from other pages, outdated documents or texts that are hard to understand.

Your privacy notice must clearly explain what data you collect, for what purpose, how you use it, who may receive it and how people can exercise their rights.

Having the link in the footer is not enough. The information must be accessible and understandable.

04. User rights

Do you know what to do when someone asks you to delete their data?

The new regulation strengthens rights such as access, rectification, erasure, objection and portability of personal data.

This means you must have a procedure to receive, manage and respond to these requests.

If someone asks you what information you hold about them or requests its deletion, you need to know who will take care of it and how to respond.

05. Providers and external services

Who else has access to the data your website collects?

Your hosting, e-commerce platform, email services, marketing tools and analytics systems may take part in processing the information.

It is important to identify which providers you use, what data you share with them and what responsibilities correspond to each one.

Sometimes the problem is not directly on your page, but in the tools you connected to make it work.

Where should you start preparing your website?

You do not need to rebuild your site from scratch or implement all the changes at once. The first step is to understand what is happening.

I would start with a diagnosis that identifies where your website collects, stores or shares personal information. This would be my initial list:

• Data inventory: identify what information you request and where it is stored.
• Forms: review the fields, the purposes and the mechanisms for information and consent.
• Cookies and analytics: identify the tools installed and how you manage consent.
• Legal texts: review the privacy policies and the information available to users.
• Providers: identify which external services take part in the processing of data.

With that information you can recognize the gaps, set priorities and plan the necessary improvements.

That said, a technical review does not replace a legal assessment. To determine your business’s specific obligations, it is important to get specialized advice.

Before a problem turns into a fine, it is better to know where you stand.

Do not wait until you have a problem to worry about your website.

Your website does not only represent your business: it is also a space where people trust information about themselves with every click.

Designing a good digital experience means thinking about more than attractive interfaces or forms that convert. It also means building experiences that are transparent, responsible and respectful of the people who use them.

If you have a website and do not know where to start, let’s talk. We can review how it works, identify opportunities for improvement and define what you need to resolve.

Talk to me to review it

This article provides general information and does not constitute legal advice. A technical review of a website does not, by itself, guarantee compliance with Law 21.719.

Last updated: October 30, 2026.

Back to blog