Personal data protection at Clikma
For legal, compliance and HR teams: what Chilean regulations require, what changes with Law 21.719, who is responsible for the data, where it is stored and how individuals' rights are handled.
- Law 21.719 explained in one table
- Controller and processor, without ambiguity
- Where the data is and what leaves Chile
- Individuals' rights and security breaches
Updated 2026-10-24
How does Clikma protect personal data and how is it preparing for Law 21.719?
In Chile, the processing of personal data is governed by Law 19.628, which Law 21.719, published on December 13, 2024, amends extensively: it creates the Personal Data Protection Agency, establishes the rights of access, rectification, erasure, objection, portability and blocking, regulates international transfers and requires security breaches to be reported. Under the law, its changes take effect on December 1, 2026; as of October 24, 2026, a bill under discussion in the Senate proposes postponing them to December 1, 2027.
When a company uses Clikma, the company is the controller of its employees' data and Clikma acts as processor: it processes the data to provide the service. The platform and its production database operate in the Santiago de Chile region, people accept the processing of their data on the platform itself, and requests for access, rectification, erasure and consent are handled through a defined procedure.
Data is protected with access control, field-by-field auditing and encryption in transit and at rest. Some support services, such as automatic database backups, email delivery and voice processing for Your Mentor, operate outside Chile with providers contracted by Clikma; this page explains which ones and why.
- 6
- individuals' rights under Law 21.719
- 2024
- year Law 21.719 was published, on December 13
- 2026
- year it takes effect according to the law: December 1
What changes with Law 21.719
Law 21.719 does not replace Law 19.628: it amends it and renames it as the law on the protection of personal data.
| Topic | What Law 21.719 establishes |
|---|---|
| Authority | It creates the Personal Data Protection Agency, an autonomous public-law corporation. |
| Individuals' rights | Access, rectification, erasure, objection, portability and blocking of their personal data. |
| International transfers | They are lawful in the cases the law establishes, including transfers to countries with an adequate level of protection. |
| Security breaches | The controller must report them to the Agency through the most expeditious means and without undue delay, and notify the data subjects when they involve sensitive data, data of children under 14 or economic, financial, banking or commercial data. |
| Effective date | From December 1, 2026, according to the law. A bill under discussion (Senate bulletin 18.623-07) proposes December 1, 2027. |
Who is the controller and who is the processor
The law distinguishes between whoever decides about the data (the controller) and whoever processes it on behalf of another (the processor). At Clikma, the roles are clear.
The client company is the controller
It decides which data about its employees it uploads to the platform and for what purposes, informs its workers and is accountable for the processing.
Clikma is the processor
It processes the data to provide the contracted service, with the security measures described on this page.
Individuals are the data subjects
They exercise their rights before the company, and Clikma helps the company respond to them.
How individuals' rights are handled
Requests are handled through a defined procedure, and several needs are resolved through self-service.
Rights of personal data subjects (Ley 21.719)
Requests for access, rectification, erasure and consent are handled through a defined procedure, and acceptance of the processing is given on the platform.
My Profile
Each person sees their training, performance, goals and notifications in a single view.
Merging of duplicate records
It merges duplicate records of the same employee to keep the data accurate.
Unsubscribe by email category
Each person can stop receiving one category of emails without unsubscribing from the others.
Where the data is and what leaves Chile
The production platform runs in Google Cloud, in the Santiago de Chile region. Some support services operate outside Chile, with providers contracted by Clikma.
If your company needs details of these services for its record of processing activities or to assess an international transfer, ask for them during the security assessment.
Data hosted in Chile
The platform and its production database operate in the Santiago region.
Database backups
They are stored, encrypted, by the same cloud provider in a multi-region location outside Chile.
Email delivery
Platform emails are sent through transactional email providers with data centers outside Chile.
Your Mentor voice practice
Voice processing for conversation practice is done in a cloud service outside Chile.
AI assistant
The assistant writes with a model hosted on Clikma's infrastructure, and the company's content does not train the model.
Security measures for the data
Access to the data is controlled, logged and encrypted.
Single sign-on (SSO) with SAML 2.0 and LDAP
People sign in with their company credentials.
Two-factor authentication (MFA)
Second factor by company and by user.
Field-by-field change audit
Who changed each piece of data, and who was impersonating if an impersonation was in progress.
Read-only user impersonation
To diagnose without changing anything, with a reason, start, end and a visible notice.
Encryption in transit and at rest
HTTPS with TLS, and the cloud provider's encryption at rest for the database, backups and files.
If a security breach occurs
A breach is handled by Clikma's incident response team using the NIST SP 800-61 method.
Containment and analysis
The team contains the incident, analyzes its scope and restores the service.
Notice to the controller company
Clikma informs the affected company through the help center so that, as controller, it can fulfill its reporting duties to the authority and to individuals.
Post-incident analysis
The incident is closed with a root cause analysis and the actions to prevent it from happening again.
How to prepare for Law 21.719
A working checklist for the company that is the controller of the data, before the law takes effect.
Inventory of processing activities
What personal data the company processes, for what purpose, on what lawful basis and who processes it on its behalf.
Contracts with processors
The obligations of each provider that processes data on behalf of the company, including its learning platform.
International transfers
What data leaves Chile, where it goes and with what safeguards.
Rights procedure
How individuals' requests are received and answered, and within what timeframe.
Breach protocol
Who detects, who decides and how it is reported to the Agency and to individuals.
Mandatory and elective training with deadlines
Staff training in data protection, assigned with a deadline and with a record of who passed it.
Frequently asked questions
What is the personal data protection law in Chile?
Law 19.628, from 1999, amended by Law 21.719, published on December 13, 2024, which renames it as the law on the protection of personal data and creates the Personal Data Protection Agency.
When does Chile's Law 21.719 take effect?
According to the law, on December 1, 2026. As of October 24, 2026, a bill under discussion in the Senate (bulletin 18.623-07) proposes postponing it to December 1, 2027: it is advisable to confirm the date before deciding.
What rights do individuals have under Law 21.719?
Access, rectification, erasure, objection, portability and blocking of their personal data.
Who is the data controller for employee data in Clikma?
The client company, which decides what data it uploads and for what purpose. Clikma acts as processor: it processes the data to provide the service.
Where does Clikma store data?
The platform and its production database operate in Google Cloud, in the Santiago de Chile region.
Does Clikma transfer data outside Chile?
Some support services operate outside Chile with providers contracted by Clikma: database backups, which the same cloud provider stores in a multi-region location, email delivery and voice processing for Your Mentor.
What does Clikma do if a security breach occurs?
Its incident response team handles it using the NIST SP 800-61 method and informs the affected company so that, as controller, it can fulfill its reporting duties.
Does Clikma use my company's data to train its AI?
No. The company's content is indexed so the assistant can answer with it and cite the source, without training the model.
Next steps: how to get started with Clikma
If you are evaluating a platform to train, assess and measure your people, this is the usual path.
Book a meeting
On the contact page you pick a time on the calendar, or you can write to contact@clikma.com or message us on WhatsApp at +56 9 7960 1634, Monday to Friday from 09:00 to 18:00.
See a demo with your use cases
We walk through the features you care about, with your processes and your numbers.
Define the scope and implementation
With a project manager, the scope, timelines and roles are set; the HR system is connected, single sign-on is configured and the training history is loaded.
Pilot run and ongoing support
Before opening it to the whole company, everything is checked and adjusted in a pilot run; after that, the Clikma team keeps supporting the operation.
Get to know Clikma with your own use cases
In a demo we walk through the features you care about, with your processes and your numbers.
Book a Demo