Law 21,719 establishes a robust liability regime for anyone violates the principles and rights and obligations established thereunder when processing personal data. The law distinguishes between minor, serious, and very serious violations, to which different penalties are applied and which shall be enforced by the Agency:

• Minor infringements shall be sanctioned with a written warning or a fine of up to 5,000 monthly tax units (approximately US$397,100).
• Serious infringements shall be sanctioned with a fine of up to 10,000 monthly tax units (approximately US$794,200).
• Very serious infringements shall be sanctioned with a fine of up to 20,000 monthly tax units (approximately US$1,588,400).
• Law 21,719 also introduces the concept of recidivism, which applies when a controller has been sanctioned two or more times within the previous 30 months. In such cases, the Agency may impose a fine of up to three times the original amount and, for large companies, penalties may reach 2% or 4% of the prior year’s gross revenues, depending on the severity of the infringement.

The law also provides for mitigating and aggravating circumstances of liability, as well as other accessory sanctions such as the suspension of the data processing operations and activities carried out by the data controller. In addition, a National Register of Sanctions and Compliance is created, in which sanctioned data controllers must be recorded. 
Affected data subjects may seek compensation for the damage they have suffered. In addition, the National Consumer Service (Servicio Nacional del Consumidor) and consumer associations may file collective actions.