Where we work · Chile
ISO and GRC certification consulting in Chile
Achieve ISO and GRC certification in Chile with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in Chile
Clients include
In short
ISO and GRC certification in Chile at a glance
Chile's data protection regime is being rebuilt: Law 21,719 amends Law 19,628, creates the Agencia de Protección de Datos Personales and adds security, breach-reporting and individual-rights duties. Beside it, the Ley Marco de Ciberseguridad created the Agencia Nacional de Ciberseguridad, whose duties reach banks, health providers, telecoms and managed IT services, while the Fintec law lets the CMF set information-security standards for registered financial firms. Companies also face criminal liability under Law 20,393, as rewritten by the economic crimes law, if they lack an effective prevention model. Export sectors add their own gatekeepers: SAG for plant health, Sernapesca for fishery and aquaculture products and the Ministry of Health for food hygiene. Certification bodies are accredited by the Instituto Nacional de Normalización, which Global ACI lists as a mutual recognition signatory. Demand comes from mining and its suppliers, fruit, salmon and food exporters, energy users, banks, global-services firms and public suppliers. Sterling's New York office serves clients in Chile on site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included. Certificates come from accredited certification bodies, never from Sterling.
Explore
ISO and GRC standards Sterling delivers in Chile
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
ISO 22301Sterling guide to the standardISO 37001Sterling guide to the standardISO 37301Sterling guide to the standard
Financial services, payments & AML
Food safety & agriculture
FSSC 22000Sterling guide to the standardHACCPSterling guide to the standardISO 22000Sterling guide to the standard
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Chile (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Ley 21.719 — Regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos Personales (Law 21,719 regulating the protection and processing of personal data and creating the Personal Data Protection Agency) Agencia de Protección de Datos Personales (the Agency created by the law), with a Consejo Directivo whose first appointment the transitional provisions regulate | Covers any processing of personal data by a natural or legal person, public bodies included, and reaches controllers or processors established in Chile as well as those abroad that offer goods or services to people in Chile or monitor their behaviour. Consent must be free, informed and specific, and the controller must be able to prove it; other lawful bases are listed separately. Controllers must publish a processing policy and contact details, apply data protection by design and by default, adopt security measures proportionate to the risk covering confidentiality, integrity, availability and resilience, report security breaches to the Agency without undue delay where there is a reasonable risk to people's rights, and tell the people concerned when sensitive, children's under fourteen or financial data is involved. People have rights of access, rectification, erasure, objection, portability and blocking, and the law covers automated individual decisions, processors that must work under a contract, and impact assessments for high-risk processing. The law creates a national register of sanctions and compliance that records certified prevention models. It cites no ISO standard. Penalties are set in the law and are not restated here. | |
| Agencia Nacional de Ciberseguridad (ANCI) Essential services, operators of vital importance and managed IT services (cybersecurity) | Ley 21.663, Ley Marco de Ciberseguridad (published 8 April 2024). It creates the ANCI as a decentralised public service and applies to institutions providing essential services, which the law lists as including electricity, fuels, water, telecommunications, digital infrastructure, digital services and IT services managed by third parties, transport, banking, financial services and payment means, health providers and pharmaceutical production, and to operators of vital importance that the ANCI designates. Obliging institutions apply the protocols and standards the ANCI issues and report significant incidents to the national CSIRT in stages, starting with an early alert within three hours. Operators of vital importance must also run a continuous information security management system and keep operational continuity and cybersecurity plans. A decree with force of law (DFL 1 of 2024) fixed 1 January 2025 as the ANCI's start date and for the law, and 1 March 2025 for articles 5, 8 and 9 and Title VII. | |
| Comisión para el Mercado Financiero (CMF) Fintech, open finance and other financial institutions under the CMF | Ley 21.521, Ley Fintec (published 4 January 2023). Entities in its registry must design, approve and implement governance, policies and controls that protect client information and ensure financial and operational continuity; the CMF sets by general rule the governance and risk standards, including cybersecurity and information security, that give a presumption of compliance. Participants in the open finance system must meet minimum standards for information security, cybersecurity, risk management and internal control that the CMF sets. | |
| Criminal justice system (Ministerio Público and the courts); no sector licensing body All private legal persons, public companies and universities of the State (corporate criminal liability) | Ley 20.393 on the criminal liability of legal persons, as rewritten by Ley 21.595, Ley de Delitos Económicos (published 17 August 2023). A legal person answers for listed crimes committed in its activity by people in a role or position, or managing its affairs, when the crime is favoured or facilitated by the lack of effective implementation of a suitable crime prevention model. The model counts as suitable when, as far as its size, complexity and resources demand, it identifies risky activities, sets protocols and procedures with secure reporting channels and internal sanctions, and assigns independent responsible persons with direct access to management. | ISO 37001, ISO 37301 |
| Ministerio de Salud (health authority) Food and beverage production, processing and packing | Decreto 977, Reglamento Sanitario de los Alimentos (Food Sanitary Regulation). Article 69 requires production, processing, preservation and packing establishments to apply Good Manufacturing Practices in a systematic and auditable way, and requires those the health authority determines, under criteria set by Ministry resolution, to implement HACCP across their whole production line under a technical norm the Ministry issues. | HACCP, ISO 22000 |
| Servicio Nacional de Pesca y Acuicultura (Sernapesca) Fishery and aquaculture products for export | Sernapesca states that it is responsible for guaranteeing the legality and sanitary quality of fishery exports and for issuing the certification required by destination markets. Its Programa de Aseguramiento de Calidad (PAC) lets processing establishments with sanitary category A or B obtain the official sanitary certification needed to export to markets that require production under a HACCP-based quality assurance system. | HACCP, ISO 22000, FSSC 22000 |
| Servicio Agrícola y Ganadero (SAG) Fruit, vegetables, seeds and other plant exports | SAG states that exporting a plant product depends on the phytosanitary requirements of the importing country's national plant protection organisation, and that SAG issues the phytosanitary certification when the importing country requires it. SAG's page does not mention ISO management-system standards. | |
| Ministerio de Salud and the Instituto de Salud Pública (ISP) Medical devices placed on the Chilean market | Article 111 of the Código Sanitario and Decreto 825 of 1998 (control of medical products and devices). As summarised in a Ministry of Health decree published in the Diario Oficial on 22 December 2022, devices brought into this control regime by decree may be made, imported, sold or distributed in Chile only if they hold the quality certification the regime requires, the technical specifications come from official Chilean standards of the Instituto Nacional de Normalización or from the Ministry, and the ISP proposes which devices enter the regime. The regime does not name ISO 13485. | |
| Ministerio del Trabajo y Previsión Social and the administering bodies of Law 16,744 Employers (occupational safety, health and workplace harassment prevention) | Ley 16.744 on occupational accidents and diseases: article 66 requires joint hygiene and safety committees in workplaces above a stated size and a risk prevention department in larger mining, industrial and commercial firms; article 66 bis makes a principal employer that contracts work out implement an occupational safety and health management system for all workers involved once they exceed a stated number. Ley 21.643 (the Karin law, published 15 January 2024) requires employers to prepare, through the administering bodies of Law 16,744, a protocol for preventing sexual and workplace harassment and violence that includes hazard identification and psychosocial risk assessment, preventive measures with measurable objectives and continual improvement. | ISO 45001 |
| Servicio Nacional de Geología y Minería (Sernageomin) Mining operations (safety regulation) | Decreto 132, Reglamento de Seguridad Minera (Mining Safety Regulation). Its objective is to protect the life and physical integrity of people in the extractive mining industry and the installations that keep operations running; article 4 gives Sernageomin general and exclusive competence to apply and enforce it, and mining companies must keep a documented system of operating procedures that ensures compliance with the regulations. | |
| Ministerio de Energía and the Superintendencia de Electricidad y Combustibles Large energy users | Ley 21.305 on energy efficiency. Companies the Minister lists as Consumidores con Capacidad de Gestión de Energía (above a stated annual end-use consumption) must implement one or more energy management systems covering at least four-fifths of their consumption, with a policy, objectives, targets, action plans, indicators, an energy manager and operational control. The law lets them meet this by certifying and maintaining a Chilean energy management system standard prepared by the Instituto Nacional de Normalización or its international equivalent, and requires periodic audits by firms approved by the Superintendencia. It does not name ISO 50001. | ISO 50001 |
| Superintendencia del Medio Ambiente (SMA) Projects and operations with environmental permits | Ley 20.417, which creates the Ministry of the Environment, the Environmental Assessment Service and the SMA. The SMA's purpose is to organise and coordinate the monitoring and enforcement of environmental qualification resolutions, prevention and decontamination plans, environmental quality and emission standards and other environmental instruments the law sets. The law does not require an ISO 14001 certificate. | ISO 14001 |
| Subsecretaría de Relaciones Económicas Internacionales (SUBREI) Exporters (mining, fruit, food, forestry and services) | SUBREI's 2025 foreign trade report records that Chilean exports reached a record in 2025, led by mining, with fruit, food, forestry manufactures and services also reported; the services exports that ranked highest included website hosting, aircraft maintenance and repair, and remote IT technical support. 8,767 Chilean companies recorded exports in 2025. It sets trade statistics, not conformity requirements, so customers decide which certificates they require. |
Accreditation and recognition
- Instituto Nacional de Normalización (INN) — accreditation service: National accreditation body — Global ACI lists INN (Instituto Nacional de Normalizacion) as a full member and Global ACI MRA signatory (code of conduct adopted on 18 June 2026). Chilean law also refers to the official Chilean standards of the INN, for example in article 111 of the Código Sanitario and in the energy efficiency law.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under Ley 19.886, as modernised by Ley 21.634 (Dirección de Compras y Contratación Pública (ChileCompra) and the contracting public bodies; Ley 21.634 was published on 11 December 2023): Ley 21.634 modernises Law 19,886 and states that public procurement follows the principles of free access, competition, transparency, equal treatment, probity and value for money, and promotes smaller firms and sustainability criteria. Suppliers are registered in the Registro de Proveedores the law regulates. The law leaves technical and quality requirements to the terms of each procurement, so a tender, not the statute, decides whether it asks for a certificate.
Economic zones
- Zona Franca de Iquique (Zofri): trade and logistics
- Zona Franca de Punta Arenas (Zonaustral): trade, industry and services
Sterling in Chile
Sterling delivers in Chile from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Chile clients ask
Who regulates personal data in Chile?
Law 21,719 creates the Agencia de Protección de Datos Personales and amends Law 19,628, which is the personal data statute. The law was published on 13 December 2024, and its amendments take effect on the first day of the twenty-fourth month after publication. Check with your counsel which rules apply to your processing today and which follow.
Which body accredits certification bodies in Chile?
The Instituto Nacional de Normalización accredits them, and Global ACI lists it as a full member and mutual recognition signatory. The recognition entries it shows are ISO 9001 and ISO 14001 for management systems, plus laboratory, inspection and product certification scopes. Other management-system standards sit in its scope tree without a date, so ask any certification body for its accreditation scope.
Are certification audits in Chile conducted in English?
Often yes for multinationals, mining groups and export-facing firms, though Chilean regulation, tenders and standards are written in Spanish. Agree the audit language, any interpreter and the language of your controlled documents with the certification body at application, and mention early if shop-floor or mine-site interviews will be held in Spanish.
Does the Chilean cybersecurity law apply to private companies?
It can. Law 21,663 applies to institutions providing essential services, which include banking, telecommunications, health providers and managed IT services, and to operators of vital importance the ANCI designates. Those bodies must report significant incidents to the national CSIRT in stages. Ask counsel or the ANCI whether your firm falls within a listed service.
Do Chilean public tenders require ISO certificates?
Not as a blanket rule in the statute. Law 19,886, as modernised by Law 21,634, sets principles such as probity, competition and value for money and leaves technical and quality requirements to the terms of each procurement. A particular tender may still ask for a certificate, so read its bases before deciding whether to certify.
Can a Chilean company be criminally liable for bribery or fraud by its staff?
Yes, in the cases Law 20,393 lists, as rewritten by the 2023 economic crimes law. A legal person answers when a listed crime committed by someone in its activity is favoured by the lack of an effective, suitable crime prevention model. Standards such as ISO 37001 can structure the controls, but the law itself decides what counts as suitable, so consult counsel.
Next step
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Ley 21.719 — Regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos Personales (Law 21,719 regulating the protection and processing of personal data and creating the Personal Data Protection Agency) — bcn.cl (accessed 18 Oct 2026)
- Ley 21.663, Ley Marco de Ciberseguridad (published 8 April 2024). It creates the ANCI as a decentralised public service and applies to institutions providing essential services, which the law lists as including electricity, fuels, water, telecommunications, digital infrastructure, digital services and IT services managed by third parties, transport, banking, financial services and payment means, health providers and pharmaceutical production, and to operators of vital importance that the ANCI designates. Obliging institutions apply the protocols and standards the ANCI issues and report significant incidents to the national CSIRT in stages, starting with an early alert within three hours. Operators of vital importance must also run a continuous information security management system and keep operational continuity and cybersecurity plans. A decree with force of law (DFL 1 of 2024) fixed 1 January 2025 as the ANCI's start date and for the law, and 1 March 2025 for articles 5, 8 and 9 and Title VII. — bcn.cl (accessed 18 Oct 2026)
- Ley 21.521, Ley Fintec (published 4 January 2023). Entities in its registry must design, approve and implement governance, policies and controls that protect client information and ensure financial and operational continuity; the CMF sets by general rule the governance and risk standards, including cybersecurity and information security, that give a presumption of compliance. Participants in the open finance system must meet minimum standards for information security, cybersecurity, risk management and internal control that the CMF sets. — bcn.cl (accessed 18 Oct 2026)
- Ley 20.393 on the criminal liability of legal persons, as rewritten by Ley 21.595, Ley de Delitos Económicos (published 17 August 2023). A legal person answers for listed crimes committed in its activity by people in a role or position, or managing its affairs, when the crime is favoured or facilitated by the lack of effective implementation of a suitable crime prevention model. The model counts as suitable when, as far as its size, complexity and resources demand, it identifies risky activities, sets protocols and procedures with secure reporting channels and internal sanctions, and assigns independent responsible persons with direct access to management. — bcn.cl (accessed 18 Oct 2026)
- Decreto 977, Reglamento Sanitario de los Alimentos (Food Sanitary Regulation). Article 69 requires production, processing, preservation and packing establishments to apply Good Manufacturing Practices in a systematic and auditable way, and requires those the health authority determines, under criteria set by Ministry resolution, to implement HACCP across their whole production line under a technical norm the Ministry issues. — bcn.cl (accessed 18 Oct 2026)
- Sernapesca states that it is responsible for guaranteeing the legality and sanitary quality of fishery exports and for issuing the certification required by destination markets. Its Programa de Aseguramiento de Calidad (PAC) lets processing establishments with sanitary category A or B obtain the official sanitary certification needed to export to markets that require production under a HACCP-based quality assurance system. — sernapesca.cl (accessed 18 Oct 2026)
- SAG states that exporting a plant product depends on the phytosanitary requirements of the importing country's national plant protection organisation, and that SAG issues the phytosanitary certification when the importing country requires it. SAG's page does not mention ISO management-system standards. — sag.gob.cl (accessed 18 Oct 2026)
- Article 111 of the Código Sanitario and Decreto 825 of 1998 (control of medical products and devices). As summarised in a Ministry of Health decree published in the Diario Oficial on 22 December 2022, devices brought into this control regime by decree may be made, imported, sold or distributed in Chile only if they hold the quality certification the regime requires, the technical specifications come from official Chilean standards of the Instituto Nacional de Normalización or from the Ministry, and the ISP proposes which devices enter the regime. The regime does not name ISO 13485. — diariooficial.interior.gob.cl (accessed 18 Oct 2026)
- Ley 16.744 on occupational accidents and diseases: article 66 requires joint hygiene and safety committees in workplaces above a stated size and a risk prevention department in larger mining, industrial and commercial firms; article 66 bis makes a principal employer that contracts work out implement an occupational safety and health management system for all workers involved once they exceed a stated number. Ley 21.643 (the Karin law, published 15 January 2024) requires employers to prepare, through the administering bodies of Law 16,744, a protocol for preventing sexual and workplace harassment and violence that includes hazard identification and psychosocial risk assessment, preventive measures with measurable objectives and continual improvement. — bcn.cl (accessed 18 Oct 2026)
- Decreto 132, Reglamento de Seguridad Minera (Mining Safety Regulation). Its objective is to protect the life and physical integrity of people in the extractive mining industry and the installations that keep operations running; article 4 gives Sernageomin general and exclusive competence to apply and enforce it, and mining companies must keep a documented system of operating procedures that ensures compliance with the regulations. — bcn.cl (accessed 18 Oct 2026)
- Ley 21.305 on energy efficiency. Companies the Minister lists as Consumidores con Capacidad de Gestión de Energía (above a stated annual end-use consumption) must implement one or more energy management systems covering at least four-fifths of their consumption, with a policy, objectives, targets, action plans, indicators, an energy manager and operational control. The law lets them meet this by certifying and maintaining a Chilean energy management system standard prepared by the Instituto Nacional de Normalización or its international equivalent, and requires periodic audits by firms approved by the Superintendencia. It does not name ISO 50001. — bcn.cl (accessed 18 Oct 2026)
- Ley 20.417, which creates the Ministry of the Environment, the Environmental Assessment Service and the SMA. The SMA's purpose is to organise and coordinate the monitoring and enforcement of environmental qualification resolutions, prevention and decontamination plans, environmental quality and emission standards and other environmental instruments the law sets. The law does not require an ISO 14001 certificate. — bcn.cl (accessed 18 Oct 2026)
- SUBREI's 2025 foreign trade report records that Chilean exports reached a record in 2025, led by mining, with fruit, food, forestry manufactures and services also reported; the services exports that ranked highest included website hosting, aircraft maintenance and repair, and remote IT technical support. 8,767 Chilean companies recorded exports in 2025. It sets trade statistics, not conformity requirements, so customers decide which certificates they require. — subrei.gob.cl (accessed 18 Oct 2026)
- Instituto Nacional de Normalización (INN) — accreditation service — global-aci.org (accessed 18 Oct 2026)
- Public procurement under Ley 19.886, as modernised by Ley 21.634 — bcn.cl (accessed 18 Oct 2026)
- Zona Franca de Iquique (Zofri) — zofri.cl
- Zona Franca de Punta Arenas (Zonaustral) — zonaustral.cl
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice