Can we use legitimate interests as the basis in Chile?

Not today. The law currently in force permits processing only where the law authorises it or the person expressly authorises it in writing, and there is no legitimate interests ground and no data protection authority. That changes on 1 December 2026, when a stricter version of the European ground arrives.

Do Chilean automated calls have to use a special prefix?

Automated and mass communications must use the 809 or 600 numbering, and since August 2025 using any other numbering for them is prohibited. The definition covers information as well as advertising purposes and names AI-generated voice expressly. Whether a security test falls inside it has not been ruled on.

Can we record simulated calls in Chile?

Treat it as requiring the affected person's authorisation. Recording a private conversation without it is a criminal offence carrying up to five years, and the statute contains no participant carve-out. Whether a party may record their own call is unsettled, so consider capturing outcomes rather than audio.

How is a monitoring measure introduced lawfully in Chile?

Through the internal regulation on order, hygiene and safety. Every control measure must use suitable means consistent with the employment relationship and must be applied generally with impersonality guaranteed. Workers and unions may challenge provisions they consider unlawful before the labour authority.

Compliance

Voice phishing simulations in Chile

Phone numbers in ChileSelf-provisioned after approval

In Chile the numbering question comes before the legal one. Since August 2025 automated and mass telephone communications have had to use dedicated numbering, the definition names communications generated by artificial intelligence in terms, and nobody has ruled on whether a voice phishing simulation falls inside it. Your own team rents the number once the filing clears, and the data protection regime you are planning against changes on 1 December 2026.

Phone numbers

Supplied by Callstrike

Local numbers in Chile, after a one-time approval.

Running a simulation

Permitted, with one question open

Whether the dedicated-numbering rule catches an internal test has not been ruled on.

Consent

Written authorisation, and it is the wrong instrument

Today's statute wants it in writing, and asking your own staff raises the problem it always does.

Getting a phone number in Chile

One approval per country, completed in the console.

Self-provisioned after approval

Your company files its regulatory details once for this country. Once that is approved, your team provisions numbers directly from available inventory. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Chile is one of the few countries where your own team rents the number from inventory once the filing clears, rather than waiting for one to be assigned, so the approval is the only thing between you and the console's own list. Both of the things it asks for are evidenced rather than typed, which is unusual here: your business name, proved by an excerpt from the commercial register, and a business address, proved by that same excerpt or by a utility bill, a tax notice, a rent receipt or a title deed. They are the two lines of the table below.

It is worth knowing which half of this page each requirement comes from. The address condition in the table is a carrier condition rather than a Chilean regulator's rule: the numbering rules ask an applicant for the type and quantity of numbering and a justification, and no address, tax number or proof of premises appears in any of them, which the sourced position sets out with what we checked. That does not make the requirement avoidable, because your provider still has to be satisfied. It does mean you should ask which instrument it comes from before treating it as immovable.

There is also a second Chilean numbering question, and it has nothing to do with clearance. It decides which numbering an automated campaign may originate from at all. It is set out below, and it is the first thing to settle rather than the last.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03Search the inventory and rent your numberYour team
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Business name	Excerpt from the commercial register
Business addressMust be within locality or region covered by the phone number's prefix; a PO Box is not acceptable where a local address is required.	Utility bill, Tax notice, Rent receipt, Title deed, Excerpt from the commercial register showing business address

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Chile?

The position in short, before your counsel reads the detail below.

Yes, and Chile is the country in this portal where the order of the questions matters most. Since August 2025 automated and mass telephone communications must use dedicated numbering, and three features of the definition each run against the assumption a reader brings from Europe: it covers information services as well as advertising purposes, it is not limited to consumers or to an existing commercial relationship, and it says in terms that it considers every type of communication, verbal, written, prerecorded and generated by artificial intelligence. The published exclusions are exhaustive and there are three of them: emergency communications, general interest surveys, and authentication the user starts. A workforce exercise is not among them.

We are going to stop there rather than tell you the answer, because the regulator has not ruled on whether an authorised internal test against your own staff is an unsolicited mass communication within that definition, and we found no decision, guidance or enforcement action applying it to security testing. Take it to Chilean counsel and to us before you design the campaign. Note one thing that follows for voice mode, because it is the opposite of the answer everywhere else in this portal: the definition covers communications originated in an automated or mass manner, and the disjunction does real work, so putting a live operator on the line is not even the direction of travel that helps here.

On the legal ground, today's statute has none of the European shape. Processing is permitted where the law authorises it or where the person authorises it in writing, there is no balancing test, and there is no data protection authority in existence to issue guidance that might soften the point. That changes on 1 December 2026, about three months from now, when a legitimate interests ground arrives in a form stricter than the European one: the interest may be pursued provided the rights and freedoms of the person are not affected, rather than asking whether those rights override the interest. Build for the incoming rules while complying with today's.

Which makes the route today an employment-law one, and its wording is the thing to design around. Every control measure must use suitable means consistent with the nature of the employment relationship, and its application must in every case be general, with the impersonality of the measure guaranteed so as to respect the worker's dignity. Scope by role and record why you chose those roles. The instrument is the internal regulation on order, hygiene and safety, compulsory from ten permanent workers, brought to workers' knowledge thirty days before it takes effect with copies to the unions and the joint committees, and any worker or union may challenge provisions they consider unlawful before the labour authority. That challenge right is the real protection here and it is the thing to anticipate.

Recording is the sharpest provision in this batch and it is criminal law. Capturing, intercepting, recording or reproducing a private conversation in premises not freely open to the public, without the authorisation of the affected person, carries from sixty-one days to five years, and the statute writes in no participant exception of the kind Brazil and Mexico enact expressly. Whether a party may record their own call is genuinely unsettled and there is no Chilean authority whose guidance could settle it. So ask first whether you need the audio at all: a programme that records the outcome and the timestamp never has to answer the question.

What your company needs to do

6 items, in the order you will need them.

Settle the dedicated-numbering question before anything elseChile-specificThis decides which numbering you may originate an automated campaign from, which is a bigger question than any of the data protection ones on this page. Put it to Chilean counsel and to us at the start, and get the answer in writing. The rule has prohibited automated or mass communications on other numbering since the transition ended, so it is not a labelling preference.
Put the measure in the internal regulation, thirty days aheadChile-specificThis is how a control measure is lawfully introduced in Chile. It is compulsory from ten permanent workers, must reach workers thirty days before it takes effect, and copies go to the unions and to the joint committees. Build the thirty days into the campaign plan rather than discovering them in the week you wanted to run.
Scope by role, and write down the rationaleChile-specificThe statute requires the measure to be applied generally with its impersonality guaranteed, so a programme aimed at named individuals is the shape the provision is written against. Testing the people who take external calls because that is what the job involves is a role rationale. Record it, because a worker or a union can challenge the regulation before the labour authority and the rationale is your answer.
Decide whether you need the audio at allChile-specificThe downside here is a criminal sentence rather than an administrative fine, and the participant question is unresolved. A programme that logs the outcome and the timestamp rather than the conversation is a materially better design in Chile, and it costs you very little of what the exercise is for.
Plan across the December 2026 change rather than up to itA programme designed now runs into a new regime within months, including a regulator that does not exist yet. Write the file so that it satisfies today's authorisation-based rule and reads as a legitimate interests assessment afterwards, and note that the incoming test is stricter than the European one it resembles.
Present a number your own organisation holdsOrdinary fraud and impersonation law applies whatever the numbering answer turns out to be, so do not display a number belonging to a bank or a public body. Present one you hold and can be reached on, which is also the position you want to be in when the numbering question is settled.

The controls that do the work

How Callstrike is configured, and which provision in Chile each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Two things this does not answer in Chile, said before the thing it does. It does not touch the dedicated-numbering question, which is what decides a Chilean campaign. And it does not answer the recording offence, which bites on capturing the conversation rather than on what the conversation obtains. What it answers is the sharpest edge of the statute in force today, which permits processing only where the law authorises it or the person authorises it in writing: the call ends the moment an employee starts to give up a credential, so no written authorisation is missing for a credential that was never processed at all.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The employer's powers are bounded at source by respect for the worker's constitutional guarantees, especially where privacy, private life or honour could be affected, and the practical form that takes is a union or a worker challenging the internal regulation before the labour authority. A call whose last minute is vishing training, delivered by a second voice that breaks character on the spot and repeated in an email, is a much harder thing to put in front of that authority as an affront to dignity than a result that surfaces weeks later in a report.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

Chile's deliverable is not a signature, it is the thirty days. The internal regulation has to reach workers before the measure takes effect, and what this produces is the dated per-employee record that it did, which a posting on a wall cannot leave behind. It carries over usefully into the new regime arriving in December 2026, whose transparency expectations will want the same evidence. It is not the authorisation the statute in force today speaks of, and this page does not present it as one.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

This is the delivery that does not depend on a ruling nobody has made. The numbering rule is about communications you originate to somebody in an automated or mass manner, and a web call the learner starts themselves in a browser after working through the module is not one, so the question the rest of this page turns on has nothing to attach to. Callstrike's vishing simulator carries the same deepfake voice through it, which matters more in Chile than anywhere else in this portal, because here the open question is about which numbers you may originate from at all.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

Two regimes, three months apart, and neither is the European one

Everywhere else in this cluster the answer is legitimate interests with a documented assessment. In Chile that is not available today, and pretending otherwise would be the most consequential error we could make on this page.

The law in force as we write is Ley 19.628. Its article 4 permits processing only where this law or other legal provisions authorise it, or where the data subject expressly authorises it, and it says that the authorisation must be in writing. There is no legitimate interests basis and no balancing test to run. That is a structural difference from the European model rather than a stricter version of it. There is also no data protection authority in existence, so there is no regulator whose guidance could soften or settle the point.

On 1 December 2026 that changes. Ley 21.719 does not repeal the old law; it amends it wholesale, including renaming it, and its own transitional article sets entry into force at the first day of the twenty-fourth month after its publication in December 2024. From that date a legitimate interests ground does exist, and its wording is stricter than the European equivalent: the interest may be pursued provided the rights and freedoms of the data subject are not affected, rather than the European formulation which asks whether those rights override the interest. A data protection agency is created at the same time.

So a programme designed today is designed across a regime change roughly three months away, and the honest planning advice is to build for the incoming rules while complying with the current ones. If you cannot obtain written authorisation now, and an authorisation obtained from an employee raises exactly the freely-given problem that makes it the wrong instrument everywhere else, then the realistic route today is the employment-law one below rather than a data protection one.

Chile has no works council and no co-determination, and nothing here should be described as either. The joint committee that exists is created for occupational health and safety in workplaces with more than twenty-five people, and its functions are protective equipment, prevention measures and accident investigation. It has no remit over monitoring or data processing and no veto over anything.

The instrument through which a control measure is actually introduced in Chile is the internal regulation on order, hygiene and safety, and the Labour Code imposes two substantive conditions on every control measure: it may be carried out only by suitable means consistent with the nature of the employment relationship, and its application must in every case be general, with the impersonality of the measure guaranteed in order to respect the worker's dignity. Impersonality is the word to design around. A programme that targets named individuals rather than applying generally is the shape that provision is written against. The regulation is compulsory for employers with ten or more permanent workers, must be brought to workers' knowledge thirty days before it takes effect with copies to the unions and the joint committees, and any worker or union may challenge provisions they consider unlawful before the labour authority. That challenge right is the real employee protection here, and it is the thing to anticipate.

Underneath all of it, the employer's powers are limited at source: the Labour Code provides that the exercise of the employer's legal powers is bounded by respect for the workers' constitutional guarantees, especially where privacy, private life or honour could be affected.

Recording is a crime unless the affected person authorised it

Chile's position here is stricter than most of this cluster and it is criminal law.

The Penal Code punishes with imprisonment and a fine anyone who, in private premises or places not freely open to the public, without the authorisation of the affected person and by any means, captures, intercepts, records or reproduces conversations or communications of a private character. The same penalty applies to disseminating them, and a higher one where the same person both obtained and disclosed. The sentence range runs from sixty-one days to five years. The only exception on the face of the provision is for those authorised by law or by judicial authorisation to carry out the acts described.

Whether a participant may record their own call is not settled by that text and we could not resolve it from a primary source. The provision conditions lawfulness on the authorisation of the affected person, in the singular, and contains no carve-out for a party to the conversation of the kind some other systems write in expressly. It does not require the authorisation of all participants either. There is no Chilean data protection authority whose guidance could settle it, and we found no official statement meeting our source standard.

So the honest position, and the one we would design to: treat Chile as requiring the affected person's authorisation by default, take the participant question to Chilean counsel, and ask first whether you need the audio at all. A programme that records the outcome and the timestamp rather than the conversation does not have to answer this question, and in a jurisdiction where the downside is a criminal sentence rather than an administrative fine, that is a materially better design.

The 809 prefix, and a definition that names AI voice outright

This is the most unusual rule anywhere in this cluster, and if you run automated calls into Chile you need to know about it before you know anything else on this page.

Since 13 August 2025, automated and mass telephone communications in Chile must use dedicated numbering. The regulator created two categories of complementary service and attributed a numbering block to each: unsolicited mass communications must use the 809 block, and solicited ones the 600 block. The rule is not a labelling suggestion. Every unsolicited mass communication must use that numbering and must route the communication so that it is visible to the subscriber, the numbering may be used only for the authorised purposes, and after a six month transition the regulator prohibited outright the making of automated or mass communications using any other numbering.

Three features of the definition matter, and each runs against the assumption a reader would bring from Europe. It covers information services and or advertising purposes, so an informational automated call is squarely inside rather than needing a commercial character. It is not limited to consumers or to an existing commercial relationship. And it says in terms that it considers every type of communication, verbal, written, prerecorded, generated by artificial intelligence, among others. An AI-generated voice is expressly in scope rather than argued into it.

The exclusions are published and exhaustive: emergency communications, general interest surveys, and authentication initiated by the user. A workforce security simulation is not among them.

We are going to stop there rather than tell you the answer. The elements are set out above; whether an authorised internal security test conducted by an employer against its own staff is an unsolicited mass communication within the definition has not been ruled on by the regulator, and we found no decision, guidance or enforcement action applying it to security testing. That is a question to put to Chilean counsel and to your provider before you design a Chilean campaign, and it is a more important question than any of the data protection ones on this page, because the consequence is about which numbers you may lawfully originate from at all.

Note what follows about voice modes. Because the definition covers communications originated in an automated and or mass manner, and the disjunction is doing work, a live operator running a mass campaign is not obviously outside it. So in Chile, unlike most of this cluster, putting a person on the line is not even the direction of travel that helps.

What you may present, and where the numbering comes from

The numbering rules above are the substance of this block in Chile, because the prefix regime determines what you may originate from rather than merely what you may display.

Numbering for the complementary services is assigned by the regulator on application, and the regulator's public guidance says that natural or legal persons originating mass communications obtain it either directly through the regulator's virtual registry office or through a private agreement with an existing holder of that numbering. So there is a route that does not require you to become a licensee, but it is a route into a specific numbering range rather than into the ordinary telephone numbering plan.

The general telecommunications law and the numbering plan govern assignment, and applications must fit the structure of the plan and be justified, with the regulator resolving within thirty days and able to refuse or to grant less numbering than requested on reasoned grounds.

What the country matrix holds for Chile

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

A requirement we could not find, said plainly

Our own onboarding has recorded that a Chilean number needs a physical Chilean address with matching proof and that a post box will not be accepted. We went looking for the rule behind that and did not find one, so this section says so rather than repeating it as law.

What we checked: the numbering plan's provisions on assignment, the resolution governing the complementary service categories, the telecommunications services regulation, and the regulator's own procedural manual. The manual states the whole documentary requirement for a numbering assignment, which is an application specifying the concession decree where one applies, the type of numbering, the quantity required and its justification. No address, no tax identification number, no proof of premises appears in any of them.

There is a Chilean establishment requirement in the general telecommunications law, but it binds concession holders, meaning carriers, rather than their customers. So the position we can support is that the address requirement you will encounter is a provider onboarding process rather than a regulator rule. That does not make it avoidable, because your provider still has to be satisfied. It does mean you should ask which instrument it comes from before treating it as immovable.

One trap worth recording, because it is the enabling-power problem in Chilean form. The resolution that governs the complementary service categories rested in its recitals on a 1996 decree that has since been repealed. The regulator re-based the citation onto the current regulation when it amended the resolution in 2025, so the chain is live, but the regulator's own public index of its regulatory framework is stale and still lists the repealed decree. Do not use that index as a currency check.

The framework cybersecurity law, and who it now covers

Chile passed a framework cybersecurity law that took effect on 1 January 2025, with several of its articles and a further title applying from March 2025. It is the closest Chilean analogue to the European network security regime, and it is a real differentiator rather than an aspiration: the national cybersecurity agency has actually designated operators of vital importance, and we confirmed the second stage of that designation in the Diario Oficial rather than from a press page.

The provision that bears on this work makes workforce cyber hygiene training a statutory duty of the entities in scope, with substantial fines available. As everywhere, the law requires training and the assessment of measures and does not name voice phishing as a required technique.

In financial services the market regulator's rules on operational risk require awareness plans covering all employees and name phishing and social engineering among the vectors an institution should assess. That is closer to naming this work than most regimes get, and it is worth citing internally when a programme needs justifying to a Chilean board.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in CHILE. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance.

Answer the numbering question first, then verify or correct each proposition below against primary Chilean sources:

1. Whether an authorised internal security test against an employer's own staff is a comunicacion masiva no solicitada within SUBTEL Res. Ex. N 1.319 as amended, given that the definition covers servicios de informacion y/o con fines publicitarios and names communications generada por inteligencia artificial.
2. Whether the three published exclusions are exhaustive, and whether any SUBTEL decision, oficio or enforcement action has applied the rule to security testing.
3. Ley 19.628 art 4 permits processing only on statutory authority or the person's written authorisation, with no legitimate-interests ground, until 1 December 2026.
4. Ley 21.719's incoming legitimate-interests ground is conditioned on the rights and freedoms of the person not being affected, which is stricter than the GDPR formulation. Advise what to build now.
5. Codigo del Trabajo arts 153, 154 and 154 ter: the internal regulation, the thirty days, the copies to unions and comites paritarios, and the challenge route.
6. Art 154 ter's requirement that control measures be general with impersonality guaranteed, and whether a role-based scope satisfies it.
7. Codigo Penal art 161-A: whether a participant may record their own call, there being no express carve-out in the text.
8. Ley 21.663 and the ANCI designations: whether we are an operator of vital importance and what its training duty requires.

Flag anything that has changed since September 2026, and identify any obligation this analysis omits.

Common questions

Can we use legitimate interests as the basis in Chile?: Not today. The law currently in force permits processing only where the law authorises it or the person expressly authorises it in writing, and there is no legitimate interests ground and no data protection authority. That changes on 1 December 2026, when a stricter version of the European ground arrives.
Do Chilean automated calls have to use a special prefix?: Automated and mass communications must use the 809 or 600 numbering, and since August 2025 using any other numbering for them is prohibited. The definition covers information as well as advertising purposes and names AI-generated voice expressly. Whether a security test falls inside it has not been ruled on.
Can we record simulated calls in Chile?: Treat it as requiring the affected person's authorisation. Recording a private conversation without it is a criminal offence carrying up to five years, and the statute contains no participant carve-out. Whether a party may record their own call is unsettled, so consider capturing outcomes rather than audio.
How is a monitoring measure introduced lawfully in Chile?: Through the internal regulation on order, hygiene and safety. Every control measure must use suitable means consistent with the employment relationship and must be applied generally with impersonality guaranteed. Workers and unions may challenge provisions they consider unlawful before the labour authority.

Elsewhere in the Americas

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.