Chile Ley 21.719 (1 Dec 2026): refresh the PTA DPA before Art. 10 templates go stale

Chile’s post-trial access duty under Código Sanitario Art. 111 C (inserted by Ley 20.850) is already live. The data-protection contract that sits beside that duty is about to change. Ley 21.719, published 13 December 2024, enters into force on 1 December 2026. A PTA data-processing agreement drafted only to Ley 19.628 Art. 10 will be stale the day that clock flips.

I am Julio Martinez-Clark, CEO of bioaccess®. This page is the DPA refresh cut of Chile PTA — not a rewrite of the supply duty. For the patient-facing obligation and the M&A successor clause, use Post-trial access in Chile under Ley 20.850 and Código Sanitario Art. 111 C. For the four-contract stack across Latin America, use The legal architecture of Latin American post-trial access.

What changes on 1 December 2026

Ley 21.719 modernizes Chile’s private-data regime. For a multi-year PTA file, the operational change is the cross-border and controller/processor transfer language. Our published legal-architecture pillar already maps the move as Ley 19.628 Art. 10 → Arts. 27–29 under Ley 21.719. That is the drafting target for any Chilean PTA DPA signed now and expected to still be in force after 1 December 2026.

Do not treat 1 December 2026 as a soft reminder on a shared drive. Treat it as a hard cutover for new signatures and for renewals that will outlive the old Art. 10 template. If your Argentina or Brazil PTA packs already went through a privacy refresh this year, put Chile on the same calendar with a named owner.

Keep Art. 111 C supply analysis separate from the DPA refresh

Art. 111 C is a free continued-supply duty that attaches to the provisional-authorization holder and then to the sanitary-registration holder — including a later buyer. That is a patient-right and product-supply problem. The DPA is a personal-data problem: who is controlador, who is encargado, what leaves Chile, and on what contractual terms.

Mixing the two in one memo is how diligence fails. A buyer can inherit Art. 111 C patients still on treatment and also inherit a DPA that no longer matches the statute. Draft the supply diligence checklist and the DPA checklist as two columns on the same closing binder page so nobody “fixes privacy” by deleting a supply paragraph.

Drafting to Arts. 27–29 now

1. Name the roles in Chilean terms. Sponsor as controlador; PTA operator / importer / cold-chain vendor as encargado where that is the real processing pattern. Do not paste a US “business associate” label and hope it maps.
2. Write the transfer regime to Arts. 27–29, not only to the old Art. 10 carve-outs. If US or EU recipients will see PTA patient data (safety, continuation, logistics), say so and attach the mechanism the new law requires.
3. Separate health-data sensitivity from commercial logistics fields. Continuation supply needs enough clinical information to treat safely; it does not need a full trial database dump into every vendor mailbox.
4. Align retention with the open-ended supply clock. Art. 111 C duration is not a neat database-lock plus thirty days. The DPA retention clause has to survive the same runway as the product.
5. Put audit and sub-processor flow-downs in the operator schedule so a cold-chain or call-center subcontractor cannot outrun the sponsor’s controller duties.
6. Version the schedule of processing activities when the PTA cohort shrinks or expands. A DPA frozen at first patient in will not describe year-three continuation reality.

What ISP’s device GCP guide does not fix for you

Chile’s first-edition device GCP guide (Resolución Exenta N° 341 of 7 April 2026 / related Res. Ex. 2.050 material already cited on the Chile PTA pillar) speaks to Art. 111 A territory and post-participation adverse-event care. It is silent on Art. 111 C’s free continued-supply duty. Silence in a GCP guide does not erase a Código Sanitario article. It also does not draft your DPA. Sponsors who treat the new guide as the full Title V picture still miss both the successor supply clause and the 1 December 2026 privacy cutover.

Operator checklist before you sign the next Chilean PTA pack

• Is the DPA template dated against Ley 21.719 Arts. 27–29, or only Ley 19.628 Art. 10?
• Does the pack separate Art. 111 C supply (who pays, who imports, who holds registro) from privacy (who processes, who transfers)?
• If an M&A is plausible before PTA ends, does the diligence file list patients still on treatment and the surviving DPA?
• Are US/EU recipients named with a transfer mechanism that will still be valid after 1 December 2026?
• Is retention tied to the supply obligation, not to “study close-out”?
• Does the operator schedule name sub-processors that actually touch identifiers or clinical notes?

How this sits beside the rest of LATAM

Brazil’s LGPD, Peru’s DS 016-2024-JUS, and Argentina’s Ley 25.326 / AAIP stack each force the same operator posture: sponsor as controller, operator as processor, written flow-downs, and a transfer story that matches the destination. Chile’s cutover date is simply the next hard calendar event on that list. Use the LATAM post-trial access operator map for country duty comparison; use this page for the Chile privacy refresh only.

If you are mid-protocol in Chile and the PTA pack still cites only Ley 19.628 Art. 10, rewrite the DPA before 1 December 2026 — and keep Art. 111 C supply on its own page of the binder. For a country-by-country PTA read, start with the operator map and the Chile pillar linked above. Market-access and registro questions stay on LATAM market access; they are not a substitute for the PTA privacy file.