The Data Paradox

We invite you to read the opinion column by Loreto Osorio, an associate in our Compliance Group, on the evolution of personal data processing in companies and the new obligations arising from the upcoming enforcement of the law in Chile.

The phrase “knowledge is power” is one of those sayings that initially struck me as empty—I hadn’t yet begun studying law, nor had I faced the real working world. My first job involved conducting background checks. The work essentially consisted of gathering clients’ personal data to assess the level of risk involved in doing business with a particular individual. Interestingly, this task is known as “Know Your Customer” (KYC). Sir Francis Bacon probably didn’t realize at the time he wrote “Nam et ipsa scientia potentia est” that companies would base their hiring practices on this process.

The information a company handles is undoubtedly an asset—and a significant one at that. It allows companies to stay ahead of trends and the market, increase profits, mitigate losses, and anticipate and prevent risks.

However, information is no longer just an asset; for many companies, it is even the most important—and, in turn, the riskiest—asset. To understand this dual nature of data, it is important to understand how data protection is being addressed in Chile.

Chile has undergone one of the most significant reforms in the area of personal data protection, urging companies to raise their data processing standards, establish compliance models, and provide channels for exercising rights. The law does not refer to just any data; it refers to personal data—that is, data pertaining to natural persons, to human beings like you and me—data that is protected by fundamental rights enshrined in the Chilean Constitution.

Processing inaccurate personal data without a legal basis, failing to provide channels for exercising ARSOP rights, breaching the duty of secrecy or confidentiality, or processing personal data fraudulently—among other activities—exposes a company to penalties that can reach approximately 1,300,000 USD.

Beyond the multimillion-dollar fines imposed by the regulator, there is a hidden cost that often proves to be even more devastating: reputational damage. When a company suffers a data breach, it not only faces paying compensation but also loses the trust of its users. In a hyperconnected era, news of a breach spreads in minutes. A customer who entrusted their personal information and sees it exposed rarely returns to use the same services. Thus, poorly managed data has the potential to profoundly damage—overnight—any organization’s most valuable intangible asset: its credibility and reputation in the market.

How can this be mitigated? By establishing models for preventing violations. These involve conducting a risk analysis to identify what personal data is collected, where it is stored, and what external and internal dangers or threats exist, as well as what compliance violations may arise from various data processing activities; providing staff training to promote careful handling of information and the ability to recognize threats; and establishing clear internal policies on the matter.

This, of course, is to avoid penalties. And even though it is up to companies to decide whether or not to establish models for preventing violations—and, in general, whether or not to comply with the law—and everything depends on the level of risk the company is willing to assume, the truth is that it is not so easy to avoid compliance. As part of this major reform—beyond the possible postponement of its effective date—the National Agency for the Protection of Personal Data is currently being established. This agency will be responsible for overseeing and ensuring compliance with these new rules, as well as imposing penalties on those who fail to comply.

Furthermore, this new landscape does not operate in a vacuum but is embedded within an increasingly demanding corporate compliance ecosystem. Today, data management must necessarily align with the risk frameworks that companies already manage under Law 20,393 on the Criminal Liability of Legal Entities and Law 21,595 on Economic Crimes.

Information processing cuts across all of the company’s processes. A model for preventing personal data breaches must speak the same language as the model for preventing crimes. If a security incident leads, for example, to computer fraud or the tampering of databases, the consequences quickly escalate to the criminal realm. Therefore, data protection is no longer just an “IT issue” but has become a structural pillar of modern corporate governance, requiring senior management to take an active role.

To achieve this adaptation, a profound shift in mindset is necessary. Gone are the days of voracious data collection under the premise of “let’s keep everything just in case.” Today, the principle of data minimization prevails: collecting only what is strictly necessary for the stated purpose. This leads us to the concept of Privacy by Design, which implies that information protection must be integrated from the very conception of any project, service, or platform—not as a last-minute legal Band-Aid. Likewise, current compliance models require that legal and technological aspects operate like a well-oiled machine. Policies and manuals on paper are utterly insufficient if they do not translate into actual access controls, encryption systems, anonymization, and cybersecurity measures applied to day-to-day operations.