Can insurers process health data? The challenge posed by the new Personal Data Protection Law

Carla Illanes, partner at Alessandri and head of the Personal Data practice area, analysed the limits on insurers’ use of health information at the seminar “Regulatory Challenges: How can personal data and insurance be reconciled?”

The event, held on 22 October at the Universidad Diego Portales Faculty of Law, was organised by the UDP Civil Law Academy’s Law and Technology Project and the Asociación de Aseguradores de Chile.

Illanes explained that health data are necessary to assess risks, underwrite policies and manage claims. This operational need must be reconciled with the requirements for protecting sensitive information and identifying a legal basis for each purpose.

“Health data are not incidental to the insurance industry; they are indispensable,” the lawyer said.

In this context, having a signed insurance contract does not, in itself, constitute sufficient authorisation for any processing of health information.

Law No. 21,719, which amends Chile’s personal data protection regime and establishes the Personal Data Protection Agency, includes health data among the sensitive categories. Their processing is subject to enhanced rules and specific provisions on health information and human biological profiles.

Article 16 establishes express consent as the general rule for processing sensitive data and provides for legal exceptions. Article 16 bis, in turn, introduces a specific restriction on health and biological profile data collected in the insurance sector: it prohibits their processing and transfer unless a law expressly authorises this in the qualified cases set out in that provision.

The analysis must therefore take account of both the general rules and the specific restrictions. Consent should not be understood as a universal legal basis that allows the latter to be disregarded.

The rules also require the lawfulness of processing to be demonstrated, data to be limited to what is necessary for each purpose, and security and confidentiality measures to be adopted. For insurers, this framework calls for a review of their procedures for collecting, using and retaining information.

Regarding the implementation timetable, a Alessandripublication dated 4 November reported that the Senado had approved a bill to postpone the entry into force, scheduled for 1 December 2026, to 15 October 2027. According to the publication, the bill still had to be reviewed by the Cámara de Diputadas y Diputados; the postponement was not presented as a change to the law already in force.

The seminar opened with remarks by Undersecretary of Economy Karlfranz Koehlerand the president of the Asociación de Aseguradores de Chile, Alejandro Alzérreca. The opening address was delivered by Iñaki Pariente de Prada, former director of the Basque Data Protection Agency.

The programme also included Jaime Parra García, Francisco Serqueira, Macarena Gatica, Juan Pablo Dolfini and Felipe Casale, as well as Illanes. The panels were moderated by Alejandra Barrera and Raúl Arrieta.

Key facts

• Jurisdiction: Chile
• Event: “Regulatory Challenges: How can personal data and insurance be reconciled?”
• Date and venue: 22 October 2026, UDP Faculty of Law
• Organisers: UDP Civil Law Academy’s Law and Technology Project and the Asociación de Aseguradores de Chile
• Participation by Alessandri: Carla Illanes, partner and head of the Personal Data practice area
• Legal focus: legal bases and restrictions for processing health data in insurance
• Legislation: Law No. 21,719, particularly the rules on sensitive and health data