To verify your company at any financial service you hand over your RUT (Chilean tax ID), your incorporation deed, your partners’ ID cards and a declaration of the source of funds. That’s a lot of sensitive information, and the right question isn’t whether to hand it over — the law requires it to be asked for — but what rights you keep over it afterwards.
The answer is changing, and for the better.
The law in force today: pioneering, but toothless
Chile had Latin America’s first data protection law: Law N°19.628, from 1999. It recognizes rights of access, rectification, cancellation and objection, but with two weaknesses that turned it into dead letter: it created no authority to enforce it, and its penalties are so low that non-compliance is cheaper than compliance. If a company ignores your request, your only route is a lawsuit.
What’s coming: Law N°21.719
Published on 13 December 2024, it comes into force on 1 December 2026 and overhauls the whole system:
- It creates the Personal Data Protection Agency, an authority that supervises and penalizes. You no longer depend on suing: you can complain.
- It broadens the catalogue of rights: access, rectification, erasure, objection, portability (taking your data to another provider in a usable format) and blocking.
- It sets deadlines: the controller has 30 calendar days to respond to a request, extendable once.
- It sets real fines: up to 5,000 UTM for minor infringements, 10,000 for serious ones and 20,000 UTM for very serious ones, with the possibility of doubling for repeat offences.
The nuance that matters to a financial client
There’s a clash of laws worth understanding before invoking the “right to be forgotten” with a payments service: Law N°19.913 requires financial institutions to retain their clients’ and transactions’ records for at least five years. During that period, a deletion request cannot reach the verification file — the legal retention obligation wins.
What you can always demand: knowing what they hold about you, correcting it if it’s wrong, that they don’t use it for anything other than what was declared, and that once the legal period expires, it goes.
How this works at SendFlow
Our position is simple: process little, disclose everything.
- The site processes the minimum. No cookies, no analytics, no trackers. The quote tool works with anonymous amounts, and your browsing feeds no third party.
- The verification file is kept for the legal period of five years, encrypted and with access closed by default. What it contains, on what legal basis and who the processors are is spelled out in the Privacy policy.
- To exercise your rights: write to cumplimiento@sendflow.cl with your name, your RUT and the right you’re invoking. We respond within a maximum of 30 calendar days — the new law’s standard, adopted from now, without waiting for December.
The full version, with lawful bases, processors and retention periods, is in the Privacy policy.
Sources: Law N°21.719, Library of the National Congress of Chile; Gobierno Digital — practical implementation guide for the new law; Law N°19.628 and Law N°19.913, Library of the National Congress of Chile (leychile.cl).