Your CRM stores the names, emails and cell phone numbers of hundreds of people, your team records meetings with AI, and you may already be testing an agent on WhatsApp. If a customer asks where you got their number or which country their conversation ended up in, do you have the answer in writing?
That's the question Law 21.719, Chile's new personal data protection law, puts on the table. In this guide you'll see what it is, when it takes effect, what changes in your CRM, prospecting, recorded meetings and AI-powered customer service, plus a checklist for SMBs. This is not legal advice: review it with your lawyer.
What Law 21.719 is and when it takes effect
Law 21.719 is the Chilean law that regulates the protection and processing of personal data and creates the Personal Data Protection Agency. It was published on December 13, 2024, and thoroughly overhauls Law 19.628 of 1999: it adds rights for individuals, new duties for companies and a system of fines.
Under its first transitory provision, it takes effect on December 1, 2026 (official text from the BCN, Chile's Library of Congress). On September 1, 2026, the Executive introduced a bill in the Senate to postpone it to December 1, 2027 (Bulletin No. 18.623-07), which is still at its first stage; a shorter six-month extension has also been proposed in the Senate (reviewed in October 2026). Until it is published as law, the 2026 date stands.
The Personal Data Protection Agency
The Personal Data Protection Agency (Agencia de Protección de Datos Personales) is the autonomous technical body the law creates to oversee compliance, resolve complaints and impose sanctions. Fines reach up to 5,000 UTM (Chile's monthly tax unit) for minor infringements, 10,000 UTM for serious ones and 20,000 UTM for very serious ones, and repeat offenses can triple them. During the law's first year in force, the Agency may sanction smaller companies with a written warning.
Key concepts: personal data, legal bases, consent and rights
- Personal data: information linked to an identified or identifiable natural person. In a B2B CRM, company data isn't personal data; your contact's name, email and cell phone number are.
- Sensitive data: health, ethnic origin, political or union affiliation, biometric data and socioeconomic status, among others, subject to stricter rules.
- Controller and processor: the controller (your company) decides why and how data is processed; the processor (your CRM, transcription or AI provider) processes it on your behalf and according to your instructions.
Legal bases
The legal bases for processing are the legal grounds for processing a piece of data; you must be able to prove which one you rely on in each case:
- The data subject's consent.
- A legal obligation, such as issuing an invoice.
- A contract with the data subject or pre-contractual steps they requested, such as a quote.
- Legitimate interest, as long as it doesn't infringe on the data subject's rights.
- Economic, financial, banking or commercial obligations.
- Defense of a right before the courts or public bodies.
Consent and data subject rights
Consent must be freely given, informed, specific, prior and unambiguous, and it can be withdrawn at any time; the burden of proving it falls on the company. Data subject rights are access, rectification, erasure, objection, portability and blocking. You have 30 calendar days to respond to a request (extendable once for another 30) and 2 business days to act on a temporary blocking request.
What changes for your customer and lead database in the CRM
Personal data protection in your CRM comes down to four areas:
- Source and basis. Record on each contact's profile where they came from and the basis on which you process their data.
- Purpose. Data collected to prepare a quote can't be used for another purpose unless that purpose is compatible, falls within the contractual or pre-contractual relationship, or you obtain new consent.
- Direct marketing. People can object, including to profiling: your CRM needs an opt-out flag that your campaigns respect.
- Retention. Keep data only as long as necessary; the law requires you to erase or anonymize data obtained for pre-contractual steps, such as a quote.
For more detail, see our guides on lead management, customer history and Odoo CRM.
Prospecting and LinkedIn: what data you can use and how
A profile that's visible online is still personal data, and you need a basis to process it. Even data from publicly accessible sources is subject to the law: the data subject can object if there's no other basis, and if you organize or combine that data, you're bound by a duty of confidentiality.
- Don't upload databases of unknown origin: the law requires lawful sources.
- Document the basis for your cold outreach (in B2B, legitimate interest is usually the basis assessed).
- In your first message, say who you are, how you got their data and how they can opt out.
- LinkedIn's User Agreement also prohibits scraping profiles with bots and using bots to add contacts or send messages.
What to delegate to AI is covered in AI sales automation.
Recording and transcribing meetings with AI: consent and notice
Recording a meeting means processing personal data: voice, image and everything that's said. With customers or prospects, the clearest approach is to ask for consent to record the meeting with advance notice:
- State in the invitation that the meeting will be recorded and transcribed, and why; at the start, offer not to record.
- Sign a data processing agreement with the transcription provider and set how long audio and text are kept.
- If the tool identifies each person by their voice, you're processing biometric data, which as a general rule requires express consent.
Odoo 20 lets you record Discuss calls and get summaries (release notes); availability depends on the version and plan. How to move from the meeting to the CRM is covered in AI sales meetings.
Customer service with AI agents: providers, transfers and logging
When it comes to AI agents and personal data, the law weighs in on three points:
- The provider is a processor. You need a contract that sets out the subject matter, duration, purpose and types of data; the provider can't use the data for any other purpose or subcontract without your written authorization, and must notify you of security breaches.
- International transfers. If the provider processes data outside Chile, the country must offer an adequate level of protection as determined by the Agency, or the transfer must be covered by contractual clauses or other safeguards.
- Automated decisions. People can object to decisions that produce legal effects on them or significantly affect them (with exceptions, such as a contract or their express consent), and you must always guarantee an explanation and human intervention. Systematic profiling with significant effects, or large-scale processing, requires a prior impact assessment.
Watch the retention: Odoo 20 keeps conversations with agents for up to 30 days after the last message. How to design the service is covered in AI customer service.
What changes and what to do in each process
| Process | What changes | What to do |
|---|---|---|
| Customers and leads | Prove the basis and purpose | Fields for source, basis and marketing opt-out |
| Prospecting | Public data is regulated; right to object | Document the basis and offer an opt-out |
| Recorded meetings | Processing of voice, image and content | Notice, consent and a deletion deadline |
| AI customer service | Human intervention in automated decisions | Human in the loop, least-privilege permissions and logging |
| Providers | Processing agreement and transfer rules | Review contracts and the processing country |
Compliance checklist for SMBs (and what to review with your legal advisor)
- Inventory of personal data: where it lives (CRM, ERP, email, spreadsheets, AI) and where it came from.
- Basis and purpose of each processing activity, in writing.
- Data processing policy published on your website: data, purposes, bases, retention periods and rights.
- Rights request channel: an email address or form, an internal owner and a response within 30 calendar days.
- Contracts with every provider that processes data on your behalf.
- Least-privilege permissions for users and AI agents: the law requires data protection by design and by default.
- Retention periods by data type, with erasure or anonymization.
- Incident protocol to report breaches to the Agency without undue delay.
With your advisor, also review legitimate interest, sensitive data, transfers, impact assessments and the infringement prevention model (voluntary).
Why work with KPB Solutions
KPB doesn't provide legal advice: your lawyer sets the criteria and we build them into your systems. In our Odoo implementation we configure role-based permissions, source and consent fields, and change tracking. And when we use Kersify to design a custom AI assistant or agent for your CRM, whether or not it's Odoo, we start with a human in the loop, least-privilege permissions and an action log. We're an Odoo Gold Partner, with more than 70 active clients in 6 countries.
Want to review your CRM and AI tools before December? Book a meeting and we'll go over your case.
