Chile - Prevention Models Regulation (662/2025)

Overview

Decree No. 662 (dated 13 June 2025, as reported by legal commentators) approves the implementing regulation that sets out the procedural and substantive requirements for the adoption, certification, registration and supervision of voluntary Models of Prevention of Infringements (Modelos de Prevención de Infracciones — MPI) under the new data protection regime introduced by Law No. 21.719. The MPI is conceived as a structured compliance programme that controllers may adopt to organise governance, reduce risks and demonstrate due diligence in the processing of personal data. Several legal notices and specialist summaries explain that, at the time of reporting, the decree had been submitted to the Contraloría General de la República for the preventive legal review known as "toma de razón" and had not yet been published in the Diario Oficial; see analysis at IAPP and a firm alert at Ontier. The decree is framed to operate together with Law 21.719, whose general entry into force is specified for December 1, 2026 in the law text available at the Biblioteca del Congreso Nacional (BCN - Law No. 21.719).

Definitions

The regulation defines core terms for uniform interpretation across certified MPIs. Among definitions reported in secondary sources: "responsible" (controller) — the natural or legal person who determines the purposes and means of processing; "delegate" (Delegado de Protección de Datos) — the designated compliance officer for the MPI who may act as an internal or independent function; "Record of Processing Activities (RAT)" — the central inventory and characterization of processing operations; "model" or "MPI" — the set of documented protocols, policies, matrices, controls and reporting channels that constitute the compliance programme; "certification" — the process by which the Agency determines that an MPI complies with the legal and regulatory benchmarks for registration; and "revocation" — Agency's administrative power to withdraw a certification in cases of material breach. The decree's drafting aims to recreate operational definitions that align with Law 21.719 terminology and international best practices.

Governance and Institutional Framework

The decree assigns primary responsibilities for the MPI architecture to the data controller and to the Data Protection Delegate and establishes the supervisory role of the new Agency for the Protection of Personal Data. The controller must adopt an MPI voluntarily and is responsible for implementing, documenting and periodically reviewing the programme. The Delegate's functions include advising on compliance, participating in programme design, receiving internal reports and interacting with the Agency. The Agency (once constituted pursuant to Law 21.719) will be the certifying and supervisory authority: certification requests will be processed in accordance with Law N° 19.880 (administrative procedure) and subsequent implementing instructions; the Agency will also maintain or supervise the Registro Nacional de Sanciones y Cumplimiento and may require information, carry out audits and, where appropriate, revoke certification. The decree therefore frames a governance chain that connects private compliance programmes with public supervisory oversight; see commentaries at Diario Constitucional and firm notes at FerradaNehme.

Key Focus Areas

The regulation elaborates minimum core components required for an MPI. As synthesised by legal commentators, these elements include: (1) clear identification of the legal entity responsible for processing and its legal representatives; (2) a comprehensive Record of Processing Activities (RAT) covering all categories of processing, legal bases, recipients and retention periods; (3) risk identification and assessment tools (data protection risk matrix and process mapping) that link identified risks to concrete preventive and mitigation controls; (4) documented internal policies, technical and organizational measures, standard operating procedures, checklists and process flows that translate legal duties into day-to-day tasks; (5) designation and description of the powers and resources of the Data Protection Delegate (internal or external), specifying reporting lines and independence safeguards where applicable; (6) protocols for incident detection, internal escalation and external notification (including triggers for notifying the Agency and affected data subjects); (7) training and awareness programmes for staff and contractors; (8) internal reporting channels, whistleblowing and non-retaliation policies; (9) internal disciplinary regimes for MPI breaches and related procedures; (10) benchmarking and periodic internal/external audits; and (11) a mechanism for documenting corrective actions and continuous improvement. The decree also addresses the content of the certificate and the public entry in the National Registry, including identification of the certified entity, legal representative, date of certification and its term (commonly signalled as 3 years in secondary analyses). Together, these focus areas aim to operationalise principles such as accountability, privacy by design and by default, transparency and proportionality as required by Law 21.719 and international standards such as the GDPR.

Implementation Framework

Procedurally, the decree reportedly establishes that certification is initiated by the applicant and is subject to administrative processing under Law N° 19.880. The Agency will issue an instruction or guide that sets application formats, documentary evidence requirements, evaluation criteria and fees (if any). Review stages described in commentary include preliminary admissibility checks, technical evaluation (which may use independent auditors or experts), an opportunity for the applicant to cure formal deficiencies, final decision and registration. Certified MPIs will have a defined validity period (commonly three years) and must be renewed to remain registered. The regulation contemplates the possibility of early revocation for misrepresentations, systemic failures or repeated breaches. Where certification is revoked, the Agency may open sanctioning proceedings provided in Law 21.719. The decree also contemplates rules to determine whether an MPI may rely on external certifications or third-party attestations as part of the evidentiary package for the application.

Monitoring and Evaluation

Supervision under the decree is based on a risk-informed approach: the Agency may request periodic reports, require access to the RAT and to MPI documentation, and carry out on-site or remote inspections. The decree describes reporting obligations for certified controllers and specifies that unreasonable refusal to provide information, or the provision of false, incomplete or intentionally misleading information, will be treated as aggravating facts in subsequent administrative procedures. Monitoring includes review of incident reports, breach metrics and remedial action logs. The regulation also contemplates indicators for programme effectiveness, such as audit results, corrective action completion rates and frequency and impact of incidents, which the Agency may use to prioritise supervisory resources.

Penalties, Liability, and Appeals

While certification under the MPI regime is voluntary, the decree clarifies that certified entities remain subject to the full sanctioning regime set out in Law 21.719. The law established an updated catalogue of infringements classified as minor, serious and very serious, with fines that can reach significant amounts (expressed in UTM). The decree outlines that false statements in the certification process, obstruction of supervisory actions, material breaches of MPI obligations and repeated infringements may give rise to revocation and enforcement actions. A certified MPI may be considered a mitigating factor in sanctioning decisions when demonstrable evidence shows effective prevention and remediation; conversely, the lack of a functioning MPI where required by the nature of processing may constitute an aggravating circumstance. The decree also preserves the right to administrative appeals and judicial review as provided under Chilean administrative law.

Relationship to Other Instruments

The decree complements Law 21.719 and interacts with other legal instruments: (a) administrative procedure law (Ley N° 19.880) for certification proceedings; (b) existing sectoral or sector-specific rules that continue to apply (for example, health or financial regulations) and may impose additional obligations; (c) criminal and consumer protection statutes where parallel liability may arise; and (d) transnational data transfer rules and contractual requirements. The decree indicates that MPIs do not displace other sectoral compliance duties and are intended to be applied in a supplementary manner to reinforce internal governance systems. Legal commentators emphasise that the MPI establishes an interoperable compliance layer that organisations can align with internal audit, risk, compliance and cybersecurity programmes.

International Alignment

The regulation is drafted to align Chile's MPI architecture with international best practices and comparable compliance schemes such as those found in the EU (e.g., accountability and DPIA requirements under the GDPR) and other Latin American modernisations. The decree's emphasis on documented Records of Processing Activities, independent Delegates, risk matrices and certification mirrors global trends in accountability-based privacy regulation. Secondary sources note that this alignment is intended to facilitate cross-border data flows, increase legal certainty for multinational controllers and support international cooperation in enforcement and standards harmonisation; however, specific provisions for adequacy or binding transfer mechanisms remain governed by other instruments and by decisions of the Agency.

Implementation Timeline

Sources and References