/ Can Insurers Process Health Data? The Challenge of Chile’s New Personal Data Protection Law

At a seminar organized by UDP Law School and the Chilean Insurers Association (Asociación de Aseguradores de Chile), Carla Illanes, partner at Alessandri and head of the Personal Data practice, discussed how the new law changes the processing of health data in the insurance industry and why it calls for closer scrutiny.

With the new Personal Data Protection Law on the horizon, the insurance industry faces a key question: how do we protect people’s data when we handle particularly sensitive information?

Carla Illanes addressed the issue as a panelist at the seminar “Regulatory Challenges: How to Reconcile Personal Data and Insurance?”

“Health data is not incidental to the insurance industry; it is essential. Without it, insurers cannot assess risk, underwrite a policy or handle a claim. In other words, without health data, the industry cannot function,” said Illanes.

The new law classifies health data as sensitive data, the most protected category. In practice, an insurer may only use it with the data subject’s express consent or where a law authorizes it. A signed insurance contract is not enough.

“The challenge is reconciling two realities. Insurers need this data to operate, but the law requires them to justify every use. So before processing any health data, the first step is to confirm there is a legal basis for that specific purpose,” Illanes said.

Law No. 21,719 is scheduled to take effect on December 1, 2026. However, the Senate has approved a bill postponing that date to October 15, 2027, which must now be reviewed by the Chamber of Deputies.

In this scenario, preparing early is a strategic decision. Companies that reach the effective date with their processes already reviewed will reduce regulatory risk while strengthening client trust and their reputation.

The seminar opened with welcoming remarks from Undersecretary of Economy Karlfranz Koehler and Chilean Insurers Association President Alejandro Alzérreca, followed by a keynote by Iñaki Pariente de Prada, former director of the Basque Data Protection Agency.