Data Protection under Ley N° 19.628 for Device Companies in Chile

1. Key takeaways

Chile’s foundational personal data protection law is Ley N° 19.628 (1999, on the protection of private life), which applies to the processing of personal data. For medical device companies, data compliance concentrates in three places: patient information involved in tecnovigilancia and adverse event reports, customer and patient information in recall and traceability records, and subject data in clinical research settings.

GRZAN’s assessment: for device companies the data compliance risk is not in marketing but in the vigilance and recall processes — those are the places where personal data genuinely moves, and the cross-border transfer step is where problems most easily arise. An adverse event report that travels from a Chilean hospital to a manufacturer abroad, or a reconciliation list naming every clinic that received a recalled batch, is personal data in the legal sense, and the obligations attach regardless of how operational the document looks. Companies that map their data flows only through the commercial and marketing lens systematically miss these flows, which is why the vigilance file, not the CRM database, is usually the first place a data compliance gap appears.

The legal landscape is layered rather than single-purpose. Ley N° 19.628 supplies the general framework of lawful processing, purpose limitation and data subject rights; Ley N° 20.120 and its implementing regulation DS 114/2010 govern research in humans, with ethics committee review as a gate; and the vigilance instruments — Article 28 of DS 825/1998 and the record-keeping requirements of the tecnovigilancia guide — compel the creation of records that are themselves personal data. A compliance programme therefore has to read the three layers together: the same adverse event file is simultaneously a regulatory submission, a record-keeping duty and a cross-border transfer of personal data.

2. Legal basis

• Law on the protection of private life | Ley N° 19.628 | 1999 | the basic legal framework of personal data protection; lawfulness of processing, purpose limitation, and data subject rights.
• Law on scientific research in humans | Ley N° 20.120 | 2006 | institutional framework for research in humans, genomics and the prohibition of cloning (applicable in clinical research settings).
• Regulation of the law on scientific research in humans | Decreto Supremo N° 114, de 2010 | published November 19, 2011 | review by scientific ethics committees and requirements for conducting research.
• Regulation on the control of pharmaceutical products and medical devices | Decreto Supremo N° 825, de 1998 | August 21, 1999 | Article 28: post-market reporting obligations.
• ISP public consultation | National Tecnovigilancia System Guide | August 27, 2026 | record-keeping requirements (receipts, investigation records, risk assessments, distribution records, recall reconciliation records).

3. Expert insights

Insight one: the tecnovigilancia report is the most typical cross-border data scenario.

Adverse event reports travel from the Chilean side to the manufacturer’s home country, and they necessarily contain patient and healthcare institution information. Under the framework of Law N° 19.628, such processing requires a clear lawful basis and purpose limitation. GRZAN recommends building de-identified fields into report templates, reducing identifiable information to the minimum necessary. The discipline pays for itself: a report that is de-identified by design travels faster, needs fewer transfer safeguards to justify, and never becomes the awkward exhibit in a later dispute.

Insight two: the data volume in recall records far exceeds expectations.

The guide requires keeping distribution records and reconciliation records of the number of units recalled. These records naturally contain customer information — hospitals, clinics, distributors. Companies tend to focus only on the recall coverage rate and overlook the compliance character of the records themselves. A reconciliation list is simultaneously the proof of recall effectiveness and a register of who bought what; treating it purely as an operations document leaves it outside any retention limit, access control or transfer rule.

The consequences of that oversight are practical, not theoretical. Distribution records with customer names sit on shared drives without retention limits; reconciliation lists circulate by email to teams abroad; none of it was ever inventoried as processing of personal data. Because these records are also the evidence set for ISP requests and civil defence, they cannot simply be deleted to solve the problem — the only workable answer is to bring them inside the data governance perimeter while keeping them retrievable for the regulatory purpose.

Insight three: clinical research settings carry two parallel sets of compliance requirements.

Where human research is involved, Ley N° 20.120 and its implementing regulation DS 114/2010 (including review by scientific ethics committees) operate alongside data protection rules. Passing ethical review does not make the data processing lawful — the two sets of requirements must each be satisfied separately. Ethics committees assess the research protocol; data protection law assesses the processing of personal data, and a clearance from one says nothing about the other.

Insight four: data compliance and vigilance deadlines are in tension, and the tension must be designed away in advance.

The 2-working-day sentinel event deadline (proposed) can conflict with de-identification work. The correct approach is to prepare de-identification templates and transfer protocols in advance, so that compliant processing never consumes reporting time, rather than remediating afterwards. Waiting for an event to test whether the compliance layer fits inside the deadline is planning to fail at the harshest moment in the system.

4. Practical recommendations

1. Build de-identified fields into tecnovigilancia report templates, reducing identifiable information to the minimum necessary for the report’s regulatory purpose.
2. Prepare lawfulness documentation and data processing agreements for cross-border transfers, with purpose limitation stated explicitly for each flow.
3. Bring recall and distribution records into data compliance management, treating them as regulated data and not merely as operations records.
4. In clinical research settings, satisfy the ethical review and data protection requirements separately, tracking each as its own workstream with its own evidence.
5. Pre-position de-identification templates and transfer protocols, ensuring compliant processing never consumes the reporting deadline.

5. Verification checklist

• □ Tecnovigilancia report templates include de-identified fields by design
• □ Cross-border data transfers have lawfulness documentation and processing agreements
• □ Recall and distribution records are included in data compliance management
• □ Clinical research settings satisfy both ethical review and data protection requirements
• □ De-identification templates and transfer protocols are pre-positioned

Regulatory information verified as of October 29, 2026.

GRZAN supports manufacturers, importers and authorised representatives with post-market compliance in Chile, including tecnovigilancia reporting, FSCA and recall execution, record-keeping systems and SEREMI inspection response. For a product-specific feasibility assessment or post-market compliance support for the Chilean market, contact the GRZAN regulatory team at info@grzanglobal.com.