By Mario Morales, Partner of Consulting and Strategy at CCL Auditores Consultores.
The discussion surrounding Chile’s new Personal Data Protection Law has been largely dominated by a legal and regulatory perspective. Much of the debate has focused on obligations, sanctions, institutional frameworks, and enforcement mechanisms. However, for organizations, the real challenge lies elsewhere. More than a new legal requirement, this law presents an opportunity to rethink how one of the most valuable business assets is managed: information.
It is natural for organizations to be concerned about potential fines. Nevertheless, reducing this transformation to mere regulatory compliance would repeat a mistake we have seen with many previous regulations. Organizations often approach these changes as projects aimed solely at avoiding penalties, when in reality they offer an opportunity to reassess how value is created and how management capabilities are strengthened.
Modern regulations are no longer designed only to restrict behavior; they also reshape the way organizations are managed. The new law is a clear example of this. Its core principles—lawfulness, transparency, proportionality, security, and accountability—are not merely legal concepts. They are management principles that require organizations to ask fundamental questions: What information is being collected? For what purpose is it being used? Who has access to it? How does it contribute to the organization’s business strategy?
Data protection will no longer be an issue reserved exclusively for legal or technology departments. Instead, it will become a matter of executive management, governance, and organizational sustainability. At the same time, it represents an opportunity to break down the silos that have historically separated critical functions within organizations. Management control, risk management, technology, cybersecurity, legal affairs, and corporate strategy will need to operate under a more integrated approach.
Only then will compliance cease to be viewed as a cost and become an organizational capability capable of generating differentiation, strengthening business intelligence, and creating value.
It would be a mistake to view this phenomenon solely through the lens of risk. The real opportunity lies in strengthening trust—one of the scarcest and most valuable assets for competing in an environment where customers, employees, investors, and regulators increasingly demand organizations that are transparent, accountable, and responsible.