Compliance with Act No. 21.719

Chile regulated data protection in 1999 with Law 19,628, a statute with no supervisory authority and no effective sanctions regime. Law 21,719, published on December 13, 2024, replaces that framework with one of European standard, and takes full effect on December 1, 2026.

For the telematics sector, the change is not cosmetic. Our business consists of continuously recording where a person is during their workday, what deliveries they make and to whom, and, when there is a camera, what happens on the road. That is precisely the type of processing the law places under greater scrutiny.

The law distinguishes according to the nature of the treatment, not according to the size of the company. Three characteristics of our activity activate the highest requirements.

• Systematic and large-scale monitoring: a connected fleet produces positions continuously throughout the day. It is not a timely record: it is a permanent follow-up of identifiable persons.
• Video and third-party data: the Drometra Vision road camera and the Drometra Spaces pilot capture people who have no relationship with our customer. Today we do not perform biometric identification; if it were ever offered, the data would be sensitive by legal definition and would require a reinforced lawful basis and an impact assessment.
• The position of the manager against many responsible: We treat data on behalf of each client. A breach of our own spreads to all of them, and the law establishes joint responsibility when we delegate without permission.

The practical consequence is that designating a data protection delegate, keeping a record of treatment activities and making impact assessments are not optional good practices for us: they are the floor.

This table is the reason why the page exists. It is easy to declare compliance in abstract; the useful for those who evaluate us is to see what is closed, what is in progress and what has not started.

The law requires appointing a data protection officer when the core activity involves large-scale processing of sensitive data, or regular and systematic large-scale monitoring of data subjects. Fleet telematics falls squarely within the second case.

We will designate the delegate before 1 December 2026 and we will publish his name and direct contact on this page and in the privacy policy. [email protected].

• It acts independently and does not receive instructions on how to exercise its function.
• It reports directly to the higher administration, without intermediaries that can filter an uncomfortable finding.
• It is the point of contact with the Agency and the headlines.
• It cannot be punished or removed for the exercise of its functions.

The law does not set a number of hours. We adopt internal deadlines because "without undue delay" needs to be translated into a procedure to mean something: we notify the affected client within 24 hours from the time we confirm the incident, and the Agency within 72 hours when we are responsible. That 72-hour period is the standard compared to which Chilean practice converts.

In repeated infringements the fine can reach 2% or 4% of the offender's annual income, depending on the gravity. In addition, the Agency has a public and free National Register of Sanctions and Compliance, which shows who was punished, why, and with what penalty. For a company that sells confidence, this advertising is more than the amount.

The law recognizes attenuating: self-reporting to the Agency, active collaboration in the investigation, voluntary reparation of the damage, the absence of prior sanctions and the diligent performance of the duties of management and supervision, which is credited with a certified model of prevention of violations.

If you operate a fleet in Chile, the law reaches you as responsible for the treatment. You use a platform that does not transfer that responsibility to the supplier. What a good supplier does is give you the means to comply; what makes a bad one is to leave you with a configuration that you cannot justify in the face of a control.

1. 1.Lift what data captures your operation today. The platform's privacy notice data table serves as a base inventory.
2. 2.It provides a basis of legality for each purpose. If a capture is not of clear purpose, the problem is not documentary: it should not be active.
3. 3.Check your internal rules of procedure. Telematics control must be recorded there and known to the workers.
4. 4.Inform drivers what is recorded, for what and for how long, in language that is understood.
5. 5.It defines retention periods in writing; the retention policy indicates which ones the platform applies automatically and which are carried out on request.
6. 6.Sign the data processing annex with us. It is the contract that Article 15a requires and without it the order is irregular.
7. 7.Prepare your rights procedure: who receives a request from a driver and within what time.
8. 8.If you are going to participate in the Drometra Vision beta or in a Drometra Spaces pilot, carry out the impact assessment before capturing video of real people.

We support that work at no additional cost for current customers: configuration review and a technical excerpt for the internal regulations. We do not provide legal advice or replace it.

Law 21.719 does not yet have all its regulations, and the Agency will have to decide on appropriate countries, certification procedure and control criteria. Whenever this happens and affects one of the rows of the state table, we update this document and record what changed.

If you detect an error on this page or an obligation that we are not considering, write to [email protected]'d rather correct it here than in a check.