Compliance FrameworksAmericas
Chile Law 19.628
Chilean Personal Data Protection Law - data quality, consent, sensitive data, data subject rights.
Chilean Personal Data Protection Law - data quality, consent, sensitive data, data subject rights.
| Short name | CL 19628 |
| Region | Americas |
| Country or scope | Chile |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers CL 19628
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for CL 19628.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 23: 1 written for CL 19628 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CL-19628-11 Due Diligence in Data Custody | The party responsible for a data registry must take care of it with due diligence and answers for damages; demonstrable integrity controls over the processing software evidence that diligence (Law 19.628 Art. 11) | Scan |
CL-19628-06 Currency and Elimination of Stale Data | Data must be modified, blocked or eliminated when it is inaccurate, outdated or lacks legal basis for storage; knowing component versions is a precondition for identifying stale processing elements (Law 19.628 Art. 6-style currency obligation) | Scan |
CL-19628-09 Purpose-Bound Use | Personal data may only be used for the purposes for which it was collected, which presupposes documented, identifiable records of the systems performing each processing purpose (Law 19.628 Art. 9-style purpose limitation) | Scan |
CL-19628-REG Registry of Data Banks | Databases maintained by public bodies must be recorded in a public registry identifying the database and its characteristics; an enumerated, named component inventory supports the same discipline (Law 19.628, public data-bank registry provision) | Scan |
CL-19628-MAND Processing Under Mandate | Processing carried out on behalf of the controller under mandate must be governed by the controller's instructions, requiring visibility into which third-party suppliers provide the processing software (Law 19.628, processing-by-mandate provision) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
CL-Art4 | Consentimiento del Titular (Art. 4) |
CL-Art7 | Calidad de los Datos (Art. 7) |
CL-Art9 | Seguridad de los Datos (Art. 9) |
CL-Art10 | Derecho de Acceso y Rectificación (Art. 10-11) |
CL-Art21 | Datos Sensibles (Art. 21) |
CL-TR-01 | Transferencia Internacional de Datos |
CL-RET-01 | Plazos de Conservación y Eliminación |
CL-OP-01 | Oposición al Tratamiento |
CL-ENC-01 | Cifrado y Seudonimización |
CL-BR-01 | Notificación de Incidentes de Seguridad |
Policy templates
Written for CL 19628:
- Procedimiento de Calidad, Retención y Eliminación de Datos Personales
And 22 from the standard set, adapted to CL 19628.