Legal Alert: The Delay of the Data Protection Law Is Not a Reprieve
On September 1, the Executive submitted a bill to the Senate adjusting the implementation timeline for Law No. 21,719 and the organizational framework of the future Agencia de Protección de Datos Personales (Personal Data Protection Agency).
What the Bill Proposes
- Postpones the law’s full entry into force to December 1, 2027.
- Expands the Agency’s Governing Council from 3 to 5 members, with a quorum of three.
- Extends to 12 months before entry into force the deadline for the Council’s early appointment, so the Agency can issue its secondary regulations and standards before it begins enforcement.
- Adjusts the transitional penalty regime, extending to all regulated parties the possibility for the Agency to opt for a warning during the initial period.
Our Take
The bill changes dates, not standards. Three key points for anyone processing personal data:
The current regulation remains fully enforceable. Personal data processing continues to be governed by the existing law, and Sernac retains the authority to enforce compliance in consumer relationships. The postponement does not create a grace period.
Awareness of the issue is already well established. Boards, clients, contractual counterparties and auditors have already incorporated this matter into their due diligence standards. That expectation comes from the market, not from regulation, and is not postponed by law.
The new authority will still exercise its powers. Given the delay, the expanded Council, and the spending tied to setting up the Agency, it is reasonable to expect that it will exercise its powers — including sanctioning authority — from the very first day it is in force. The structure now being built will need to justify itself.
Download the analysis prepared by our TMT team below for full details on the bill and our recommendations: