/ Law No. 21,663 on Cybersecurity Comes into Effect

With the exception of certain articles related to OIVs, the obligation to report to ANCI and the title of infractions and penalties, the Cybersecurity Framework Law came into force on January 1, 2025.

Trinidad Moreno
Associate Attorney
Alessandri Abogados

The Cybersecurity Framework Law was published on April 8, 2024. This new law aims to establish the institutional framework, principles, and general regulations to structure, regulate, and coordinate the cybersecurity actions of State administration bodies and individuals. It sets minimum standards for the prevention, containment, resolution, and response to cybersecurity incidents, while also establishing the powers, obligations, and duties of both public and private institutions. The law will apply to institutions that provide services qualified as essential, as well as those designated as Operators of Vital Importance.

On December 24, 2024, DFL 1-21.663 was published, which sets the staff composition of the National Cybersecurity Agency (ANCI, for its Spanish acronym) and determines the law’s entry into force.

The general provisions of the Cybersecurity Framework Law came into effect on January 1, 2025, the same date that the National Cybersecurity Agency began its activities.

However, the following articles will come into force on March 1, 2025:

•  a) Article 5: Classification by ANCI of Operators of Vital Importance.
• b) Article 8: Specific duties of Operators of Vital Importance.
• c) Article 9: The obligation to report cybersecurity attacks and incidents that may have significant effects to the National CSIRT.
• d) Title VII: Detailing the violations of the law and the corresponding sanctions.

The President of the Republic Gabriel Boric appointed attorney Daniel Álvarez Valenzuela as the first director of the Agency. Although the director must be appointed by the High Public Management System, Article 2 of the Law empowered the President of the Republic to appoint the first Director of the National Cybersecurity Agency, who will take office immediately, for a maximum term of one year and while the relevant selection process is carried out according to the High Public Management System.

Should you need to contact our specialized team in Technology, Data Protection, and Cybersecurity, please write to us at alessandri@alessandri.cl.

https://chambers.com/articles/law-no-21-663-on-cybersecurity-comes-into-effect