We share the opinion column written by our Labor Group Director, Jocelyn Aros, and Senior Associate az Tech, Antonia Nudman, on changes in the processing of personal data in employment contracts.
For years, in Chile, we became accustomed to seeing the same clause in employment contracts: “The employee authorizes the company to process their personal data…” followed by a long list of purposes. It was almost a wild card, serving all purposes, and no one questioned whether that consent was truly free.
With the new Law 21.719, which comes into force on December 1, 2026, that logic changes completely. The focus is no longer on ‘asking for authorization for everything’ and shifts to something much more uncomfortable for companies, which will have to justify why the data is being processed and on what specific legal basis.
In the world of work, the comparative experience is clear, as the main basis is not consent, but the execution of the employment contract and compliance with legal obligations.
Basically, the explanation is quite simple: the employment relationship is, by nature, one of subordination and dependence. The employer, in the exercise of their legitimate powers, makes relevant decisions about hiring and the continuity of the relationship.
The European experience sets a precedent in this area, where data protection authorities have indicated that, in general, consent is not a viable legal basis in the workplace. If we apply this to the Chilean context, the message is that standard clauses in employment contracts will have to be modified to comply with the new regulations.
For most of the usual data processing in the workplace (payment of salaries, attendance monitoring, use of corporate email, performance evaluations, risk prevention, social security, among others), the appropriate legal basis will mainly be the need to execute the employment contract or comply with legal obligations, rather than the employee’s consent.
This does not mean that consent disappears from the workplace, but rather that it ceases to be the default basis for the employment relationship.
For the areas of people, human resources, compliance, and legal teams, this implies a significant shift. It is no longer enough to add a standard clause to the contract. It will be necessary to map out what data is processed and for what purpose, link each processing operation to its legal basis (performance of a contract, legal obligation, well-considered legitimate interest, or consent), reflect this in the Processing Activities Register, and explain it to workers in language they can understand.
Companies that reach December 2026 with the same contract models, full of generic authorizations, risk that these clauses will not even serve as a basis for legality, and that the future agency will see them as a sign that the cultural change brought about by the reform has not been understood.
The time to put your house in order is now: review contracts, internal regulations, and annexes; update policies; and, above all, rethink the relationship between corporate control and the private life of the worker.
In short, leaving behind ‘blanket consent’ in employment contracts should not be seen as an additional burden, but as an opportunity for companies to put their legal foundations in order, reduce regulatory risks, and strengthen trust with their teams.
Column written by:
Jocelyn Aros | Director Labor Group | jaros@az.cl
Antonia Nudman | Senior Associate az Tech | anudman@az.cl
