Soon.
- Act No. 21.719 was published on 13 December 2024 and its changes to the personal data law have been in effect since 1 December 2026.
- It has a specific article on geolocation: it is necessary to inform which data are treated, for what, for how long and if shared with a third party.
- During the first 12 months, the Agency may issue a written warning to smaller companies.
If your truck has GPS, or your delivery man shares the location from the phone, you are recording where a person is during your day. And your list of offices has names, phones and customer addresses. All this is personal data, and since December 1, 2026 it is governed by a law that is much more demanding than the current one.
What does the law say about location
Act No. 21.719 adds to Act No. 19.628 an article dedicated to geolocation, which states:
«The processing of the personal geolocation data of the holder may be carried out under the same sources of legality as set out in Articles 12 and 13. The data holder shall be informed in a clear, sufficient and timely manner of the type of geolocation information to be treated, of the purpose and duration of the processing and whether the data shall be communicated or given to a third party for the provision of a value-added service.»
The "sources of legality" are the reasons for the processing of a data. Article 12 is the consent, which must be free, informed and specific. Article 13 lists others, including the treatment required to perform a contract with the holder or to satisfy a legitimate interest of the person responsible, provided that the rights of the holder are not affected.
In practice, what the law explicitly requests for location is transparency: that the driver know what is recorded, for what, how long it is kept and who else sees it.
What else changes
- The Agency for the Protection of Personal Data must be informed of any security violations that expose data, without undue delay, where there is a reasonable risk to the holders (Article 14 sexies).
- The law requires the Agency to set minimum standards of information and security that are differentiated according to, among other factors, the size of the company (article 14 septies).
- For the first 12 months of its validity, where it is appropriate to punish a smaller undertaking, the Agency may apply a written warning (Article 6 transitory).
This article summarizes the official text of the law to guide. It is not legal advice: if your case has particularities, contact a lawyer.
What to order before 1 December
- 1Make an inventory: what location data you keep, what vehicles and people, what you use them for, and how long you keep them.
- 2Please inform each driver in writing what is registered, for what purpose, for how long and if seen by a third party, as your GPS provider.
- 3Set a conservation period and delete what you no longer need: save everything "just in case" is no longer a safe option.
- 4Limit who can see the travel history and the customer lists.
- 5Check what the contract says with your GPS or software provider about where you keep the data and what you do with it.
- 6Have it written what you will do if the information is filtered: to whom you warn and in how long.
Sources
- 1.Law 21.719: regulates the protection and processing of personal data and establishes the Agency for the Protection of Personal DataLibrary of the National Congress (LeyChile) · publicada el 13 dic 2024
- 2.Video surveillance, biometric control and geolocalized monitoring of workers in the light of Law 21.719UANDES Digital Legal Review