🇨🇷Law 8968 on the Protection of the Person Regarding Processing of Personal Data
Law 8968 and its Regulation
The regime is built on informed consent, data quality, proportionality, security, confidentiality and effective guarantees for access, rectification, cancellation and objection.
Operational requirements
The Regulation requires documented processing procedures and privacy/security protocols, administrative, physical and logical measures, risk analysis, processor terms, transfer evidence and prompt rights handling. Revocation is generally actioned within five business days; rights requests are answered within five business days.
When a breach affects personal data, the controller must notify the affected holder within five business days and provide the holder and PRODHAB with the required incident information. Database registration is mapped only where the statutory distribution or commercialisation scope applies.