Manuel Carvallo
Director

Manuel Carvallo is a Chilean legal practitioner with over 34 years of experience specializing in insurance and reinsurance law. He is Managing Partner at Estudio Carvallo Abogados, one of Chile’s oldest insurance law firms, established in 1885, where he oversees the firm’s strategic direction. Since 2012, he has led the specialized division for Insurance Fraud Investigation and Prosecution, achieving landmark criminal rulings and significant loss mitigation for domestic and international carriers. He served as President of AIDA Chile (International Association of Insurance Law) from 2013 to 2015. Carvallo holds an LL.B. from Pontificia Universidad Católica de Valparaíso and a postgraduate degree from Universidad Adolfo Ibáñez.

The New Legal Framework for Data Protection in Chile: Strategic Implications for the Reinsurance Market in Chile

Introduction and Regulatory Background

The Chilean legal landscape is undergoing a structural transformation with the imminent enactment of Law No. 21,719, which substantially amends Law No. 19,628.

Scheduled to enter into full force on December 1, 2026, this reform establishes a sophisticated data protection statute aligned with international benchmarks, most notably the European Union’s General Data Protection Regulation (GDPR).

For the insurance industry, this shift transcends mere compliance; it necessitates a fundamental re-engineering of operational and strategic processes. The new framework transitions from a passive protection to an active recognition of the individual as the “owner” of their personal data, concept that previously was not applicable in Chile.

Key pillars of the Law include:

  • Extraterritorial Application: Jurisdiction extends to any entity processing data of Chilean residents, regardless of where the processing occurs.
  • Strict Accountability: The burden of proof shifts to the data controller (Responsable del Tratamiento), who must demonstrate diligent compliance through auditable management systems.
  • Establishment of the Data Protection Agency: A specialized, autonomous supervisory authority with robust investigative and sanctioning powers, including fines of up to 10,000 UTM.(equivalente at current exchange rates to approximately US$ 780.000)

  1. Core Principles and Lawful Basis for Processing

The Law introduces a set of governing principles—including Proportionality, Purpose Limitation, and Data Minimization—that must be applied concurrently to any data processing operation.

Crucially, the reform expands the “lawful basis” for processing beyond simple consent. While consent remains a valid tool, it must be free, informed, and specific. For the insurance sector, relying solely on consent is often strategically precarious due to its revocable nature. Consequently, the industry must pivot toward more stable legal anchors:

2.1. Performance of a Contract (Art. 13 c): Data processing is necessary for the execution of insurance policies or pre-contractual measures.

2.2. Legitimate Interest (Art. 13 e): Applicable where the interests of the controller or a third party do not override the fundamental rights of the data subject.

2.3. Legal Obligation: Processing required to comply with statutory mandates.

  1. Reinsurance: The Nexus of International Data Transfer

Reinsurance in Chile is done mostly to foreign jurisdictions, therefore this represents a challenge in respect of its cross-border nature and the stringent requirements of Title V regarding International Data Transfers.

3.1. Roles and Classification

In the tripartite relationship between the local insurer (Cedant), the Reinsurance Broker, and the Reinsurer, under the new law, each party will be considered as a Responsible Data Controllers, if personal data is sent to reinsurers.

Therefore, the transmission of data from a local insurer to an international reinsurer constitutes a Data Assignment (Cesión) and, typically, an International Transfer.

3.2. Applicability to Reinsurance Structures

The key aspect of exposure therefore will likely depend on the “type” of reinsurance contract being placed.

We consider that the impact of the Law varies depending on the type of reinsurance contract (as examples):

  • Automatic Treaties (Quota Share): These typically involve aggregated or anonymized “bordereaux” data, falling – in general terms – outside the scope of personal data regulations.
  • Facultative Reinsurance: This represents the primary area of risk. When specific identification (e.g., in Life, Health, or high-value Personal Accident risks) is required for underwriting, the Law’s protections are fully triggered.

  1. Cross-Border Compliance Mechanisms

The Law mandates that international transfers are only lawful if the destination country provides an “adequate level of protection” (the “White List”, likely including the EU and UK).

For transfers to non-adequate jurisdictions, insurers must implement specific safeguards:

  • Standard Contractual Clauses: Incorporating the model clauses recently approved by the Ministry of Economy.
  • Data Protection Addendums: Formalizing written agreements or Master Agreements with brokers and reinsurers to cover all future placements.
  • Transfer Impact Assessments: Conducting formal analyses of the recipient country’s legislation and the reinsurer’s technical security measures before finalizing agreements.

  1. Conclusion: From Financial Solvency to Data Solvency

Under Law No. 21,719 (when applicable), reinsurance is no longer merely a financial operation; it will involve a structure of regulated data flow.

Local insurers must embrace their role as “responsible exporters” of information, therefore there will be a need to integrate Accountability and Privacy Data Management, to mitigate the risk and enhance the trust of policyholders and international partners.

In the new digital ecosystem, excellence in data privacy is now as critical to market leadership as financial credit ratings.