Chile, Peru and Mexico rewrite their personal data rules
Chile's law also reaches foreign companies that offer goods or services to people in Chile, Peru requires serious incidents to be reported within hours and Mexico moved oversight to a federal ministry. What already applies, what is coming and what to review first.
Executive summary
Chile published Law 21,719 in December 2024, and it takes effect on 1 December 2026. On 1 September the Government submitted a bill to postpone it by one year; as of 28 September the bill was still at its first stage in the Senate.
The Chilean law also applies to anyone not established in Chile who offers goods or services to people in the country or monitors their behaviour. It creates an agency with sanctioning powers, which during the first year may opt for a written warning for smaller companies.
In Peru, the regulation in force since March 2025 requires serious incidents to be notified within 48 hours at most. Those processing large volumes or sensitive data must appoint a data protection officer, phased in by size; medium-sized firms must comply by 30 November 2026.
Mexico replaced its 2010 law in March 2025 and moved the oversight previously exercised by INAI to the Ministry of Anti-Corruption and Good Governance. Venezuela still has no general law; protection rests on the Constitution and on habeas data actions before the courts.
Context
Chile and Peru bring their rules closer to the European model, with authorities that impose sanctions, incident reporting duties and rights such as portability; Chile's law adds the right to object to automated decisions. Mexico updated its law and placed oversight in a government ministry. Brazil and Colombia already had authorities with sanctioning powers.
For a company with customers in several countries, each jurisdiction sets its own deadline, its own authority and its own scale of fines. A single privacy policy needs, at a minimum, a country annex covering those three points.
Table 1 · What applies and what changes in six countries
| Country | Rule | Authority | Next milestone or key point |
|---|---|---|---|
| Chile | Law 21,719 (2024) | Personal Data Protection Agency | Takes effect 1 Dec 2026; bill to postpone it to 2027 under debate |
| Peru | Law 29733 and SD 016-2024-JUS | National Personal Data Protection Authority | Data officer from 30 Nov 2026 at medium-sized firms processing large volumes or sensitive data |
| Mexico | LFPDPPP (2025) | Ministry of Anti-Corruption and Good Governance | In force since 21 Mar 2025 |
| Brazil | LGPD (Law 13,709) | National Data Protection Agency (ANPD) | Became a regulatory agency; Law 15,352 of February 2026 consolidated the change |
| Colombia | Law 1581 of 2012 | Superintendence of Industry and Commerce | Database registry mandatory above 100,000 UVT in assets |
| Venezuela | No general law | Courts (habeas data) | Constitution, arts. 28 and 60; Supreme Court Organic Law, arts. 167 to 169 |
Business implications
Map which countries' data is processed and where it is hosted. It is the basis for knowing which law applies. The Chilean rule reaches foreign companies whose data processing is aimed at offering goods or services to people in Chile, so the starting criterion is where the data subjects are.
Design the incident protocol around the strictest deadline. Peru's regulation sets a deadline in hours and Mexico's law requires affected people to be told immediately. A procedure calibrated to those deadlines also works as a basis for Chile, which requires reporting without undue delay.
Review contracts with providers and processors. The rules in Chile and Peru also reach whoever processes data on the company's behalf. Subcontracting, international transfer and incident notice clauses are worth reviewing.
Methodology & data
Direct reading of the official texts published in each country's official gazettes and of the Chilean Senate's bill record, consulted on 28 September 2026. The conversion of the Chilean fine uses the September 2026 UTM and the observed dollar rate of 24 September, both published by Chile's Internal Revenue Service.
For information only. This is not legal advice; each case requires review by a lawyer qualified in the relevant country.
References
Law 21,719 regulating the protection and processing of personal data. Official Gazette of the Republic of Chile, 13 December 2024. · Senate of Chile. Bill 18,623-07 amending Law 21,719 (submitted 1 September 2026). · Supreme Decree 016-2024-JUS, Regulation of Law 29733. El Peruano, 30 November 2024. · Federal Law on the Protection of Personal Data Held by Private Parties. Official Gazette of the Federation, 20 March 2025. · Law 13,709 (LGPD) and Law 15,352 of 25 February 2026. Presidency of the Republic of Brazil. · Law 1581 of 2012 and Decree 090 of 2018. Republic of Colombia. · Organic Law of the Supreme Court of Justice. Official Gazette of Venezuela 6,684 Extraordinary, 19 January 2022. · Internal Revenue Service of Chile. UTM and observed dollar values, 2026.