On August 31st, the Executive submitted to the Senate a bill contained in Bill No. 18,623-07, aimed at amending Law No. 21,719, which regulates the protection and processing of personal data and creates the Personal Data Protection Agency (APDP, for its initials in Spanish).
The initiative proposes postponing the entry into force of the new regulatory framework by one year, moving its effective date from December 1st 2026, to December 1st, 2027.
According to the presidential message accompanying the bill, the implementation of this new personal data protection system involves significant institutional, regulatory, and operational challenges. Therefore, it is considered necessary to provide additional time for the transition period and to ensure that the APDP has the appropriate conditions in place to begins its functions and timely exercise the powers granted to it by law.
What are the main amendments proposed by the Executive?
Postponement of the law’s entry into force. The bill establishes December 1st, 2027 as the new effective date of the law. If this amendment is approved, data controllers and data processors would have an additional year to advance their compliance efforts and adapt their operations to the new regulatory framework.
Strengthening of the Personal Data Protection Agency. The initiative proposes increasing the membership of the APDP’s Board of Directors from three to five members. Board members would serve six-year terms, with no possibility of reappointment, and the Board would be partially renewed every two years. In addition, the quorum required to hold meetings and adopt resolutions would increase from two to three members.
Furthermore, the bill provides that the initial appointment of board members must take place no later than twelve months before the law enters into force. Accordingly, if the bill is approved as proposed, such appointments would have to be made by December 1st of this year. It also simplifies the appointment procedure before the Senate and expressly establishes that board members will begin receiving remuneration as soon as their appointment becomes effective. From that moment onward, they will be subject to the exclusive dedication and incompatibility regime established by law.
General application of the initial written warning. The bill proposes that, during the first twelve months following the law’s entry into force, the Agency may issue a written warning to any entity subject to the law, regardless of its size. Currently, this authority is limited to smaller companies.
Implications of the new personal data protection law for organizations
Although the bill proposes extending the transition period before the new personal data protection regime becomes effective, organizations should take into account that compliance with Law No. 21,719 requires more than documentary or technological adjustments. Accordingly, even if the bill is approved, organizations are advised to continue assessing their compliance gaps and advancing their implementation plans to ensure readiness for the new regulatory framework.
Legislative status
The bill is currently in its first stage of legislative review before the Senate and was submitted with urgent status, meaning it must be considered by the relevant chamber within a period of 15 days.
You may follow the progress of the bill’s legislative process here.
For questions or further information on this matter, please contact our Corporate Legal team and review the following publications related to this topic:
Content updated as of August 2026.