Privacy and public records in Chile: the RUT, Law 19.628 and the new data protection law

Spend a week in Chile and someone will ask for your RUT: at a pharmacy counter, when you join a supermarket loyalty program, when you sign a lease or pay a bill. The same number works as a national ID, a tax ID and, in practice, a customer number. That convenience is also why Chileans' numbers travel so far, and why the rules on personal data matter more there than in places where people carry several unrelated identifiers.

This page explains the number, the public records that use it, the 1999 law that has governed personal data for more than 25 years, and the 2024 law that rewrites it. It is general information. For a dispute with a specific company or agency, a Chilean lawyer (or, once it is running, the new data protection agency) is the right next step.

The number: RUN and RUT

Two acronyms describe one number for most people.

• RUN (Rol Único Nacional, single national roll number) is assigned by the Servicio de Registro Civil e Identificación (Civil Registry and Identification Service) and printed on the cédula de identidad (identity card).
• RUT (Rol Único Tributario, single tax roll number) is the tax identifier used by the SII (Servicio de Impuestos Internos, Internal Revenue Service). For a person, the RUT is the same number as the RUN. Companies and other legal entities get their own RUT from the SII.

Both end in a hyphen and a dígito verificador (check digit), which can be 0 to 9 or the letter K. It comes from a modulo 11 formula: multiply the digits from right to left by 2, 3, 4, 5, 6 and 7, starting again at 2 when you run out, add the results, divide by 11 and subtract the remainder from 11. A result of 11 becomes 0 and a result of 10 becomes K. The digit catches typing errors. It proves nothing about who owns a number.

Because a person's RUT stays the same for life and is asked for everywhere, it links records across databases: tax, courts, the electoral roll, debt reports, loyalty programs. Treat yours as a key, not as a secret, since many people already have it, and not as a casual detail either.

What anyone can see

The 2012 electoral roll episode

In 2012, after a reform made voter registration automatic, the Servel exposed voter data twice. In April, its website let anyone type a name or RUN and see the voter's polling place and the address recorded with the Civil Registry. After public criticism, it changed the search so that it worked only with a voter's own RUN. In August, it published the audited roll with the names, RUNs and addresses of roughly 13 million voters, citing the legal duty to publish the roll, and members of the Chamber of Deputies' constitution committee objected. Chilean media covered both episodes widely, and they remain a clear example of the difference between a record being public and a whole database being posted for download.

Law 19.628: the rules in force today

Law 19.628, sobre protección de la vida privada (on the protection of private life), was published in August 1999. The current text is on the site of the Biblioteca del Congreso Nacional (BCN, the National Congress Library). What it does, in plain terms:

• Consent or a legal basis. Under article 4, personal data can be processed only with a legal authorization or the person's written consent. The same article exempts data taken from "sources accessible to the public" when it is economic, financial, banking or commercial, when it sits in lists limited to a category of people (profession, address, date of birth), or when it is used for direct marketing. That exemption is a large part of why lists with names, RUTs and addresses have circulated legally for years.
• Your rights. Article 12 lets you ask anyone who runs a database what it holds about you, where it came from, why it is kept and to whom it is regularly passed. You can demand correction of wrong or incomplete data, deletion when there is no legal basis or the data is out of date, and deletion or blocking when you gave the data voluntarily or it is used for marketing. All of this is free.
• A court route. Under article 16, the database holder has two business days to answer. If it does not, or refuses for reasons other than national security or the national interest, you can go to the civil court (juez de letras en lo civil) where the holder is based, under a short procedure.
• Limits on debt reports. Articles 17 and 18 restrict which unpaid obligations can be reported (protested bills and checks, unpaid bank and retail credit, among others) and bar reporting a debt five years after it became due or once it has been paid. Under article 19, when a debt is paid the creditor must tell the database within seven business days.

The law never created a dedicated regulator, so enforcement has depended mostly on courts. In 2018, Law 21.096 added the protection of personal data to article 19, number 4, of the Constitution, making it a constitutional right alongside privacy.

Law 21.719: what changes on December 1, 2026

Law 21.719, which regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos Personales (regulates the protection and processing of personal data and creates the Personal Data Protection Agency), was published on December 13, 2024. It rewrites Law 19.628 from the inside, and its main provisions take effect on the first day of the 24th month after publication: December 1, 2026. The text is on the BCN site.

• More rights. The classic set is known in Spanish as ARCO: acceso, rectificación, cancelación, oposición (access, rectification, cancellation, objection). The new article 4 lists access, rectification, supresión (deletion), objection, portability and blocking.
• Clear deadlines. Under the new article 11, you send a written request by email, web form or similar channel. The company must answer within 30 calendar days, extendable once by another 30, and must give reasons for any refusal. You then have 30 business days to complain to the agency, and if the company never answers you can go to the agency directly. While a correction, deletion or objection request is pending, you can ask for a temporary block on the data, which the company must answer within two business days.
• A regulator. The Agencia de Protección de Datos Personales is an autonomous public body that can supervise, issue binding instructions, handle complaints and impose sanctions.
• Public sources are no longer a free pass. The rewritten definitions say that processing data taken from publicly accessible sources is subject to the law.

A possible delay

On August 31, 2026, the government sent the Senate a bill (bulletin 18.623-07) that would move the start date to December 1, 2027 and enlarge the agency's board from three to five members. At the time of writing, in mid-October 2026, the bill was still in its first stage in the Senate, so the legal start date remains December 1, 2026. Check the bill's status before relying on either date.

Asking a company to correct or delete your data

1. Find out who holds it. A store, a bank, a debt registry, a website. Ask the company that refused you credit which registry it consulted.
2. Write to them. Identify yourself, name the data, say what you want (access, correction, deletion or blocking) and attach proof for a correction, such as a payment receipt. The request letter builder gives you a structure to adapt; write the final version in Spanish and include your RUT only in the copy you send.
3. Track the clock. Two business days under Law 19.628 today. Thirty calendar days once Law 21.719 applies.
4. Escalate. Today, that means the civil court, usually with a lawyer. After the new law takes effect, a complaint to the agency.
5. For paid debts, cite articles 18 and 19 and send the receipt to both the creditor and the registry.

A lawful public record, such as a court case or a gazette extract, generally cannot be erased on request. What you can often limit is how widely private sites copy and repackage it.

Checking a Chilean company

The same sources work in the other direction when you are the one doing the checking. Start with the company's RUT at the SII, then the Registro de Empresas y Sociedades or the Diario Oficial, then the court search. The step-by-step version, alongside Mexico and Colombia, is in researching a company in Mexico, Chile and Colombia. Search by the company's RUT, and keep partners' personal details out of your notes unless the contract needs them.

Paraguay took a different path, with habeas data in its constitution decades before a general law; see privacy and public records in Paraguay.

Your RUT, in five rules

• Give it when there is a legal reason (an invoice, a contract, a government procedure) and ask what it is for when a shop wants it for points.
• Never send a photo of both sides of your cédula unless a regulated institution requires it, and then only through its official channel.
• Check that a debt disappears from reports once paid, and put the request in writing if it does not.
• Keep copies of every data request you send, with dates.
• Note December 1, 2026 on your calendar, and watch whether the Senate moves it to 2027.