ARCO Rights Automation: The Workflow Most LatAm Companies Don't Have (and Chile's Deadline Is Coming)

ARCO rights are not a legal problem — they're a data-location and workflow problem. The law already gives you deadlines measured in days (15 in Brazil, 20 business days in Mexico, 15 in Colombia, 30 calendar days in Chile starting December 2026), and most Latin American companies have no idea where the data subject's records live or who is supposed to answer. That's why rights-request management is one of the easiest compliance processes to automate — and one of the most expensive to leave manual.

We've spent the last few months building compliance automation for clients in regulated industries — healthcare, finance, legal — and there's a conversation that repeats in every review: the ROPA exists, the privacy notice is published, consent is documented. Then a data subject request arrives and someone in operations says "this goes to legal." Legal asks "where are their records?" and nobody can answer with certainty. That gap is exactly what regulators are starting to sanction.

The regulatory clock is already running: four countries, four deadlines

Two recent changes make this urgent — not another "process improvement" to defer.

Chile's Ley 21.719 goes fully enforceable on December 1, 2026. It replaces the 1999 Ley 19.628, creates the Agencia de Protección de Datos Personales (APDP) with the power to investigate on its own initiative — no complaint required — and defines the ARCOP rights: access, rectification, cancellation or suppression, opposition and portability. The general response deadline is 30 calendar days, extendable once by 30 more with justification; if the request includes temporary blocking, that block must be resolved in just 2 business days (PrivacyCheck's explainer covers it, and the detail lives in arts. 5-11 of the law — it's also spelled out in lawyers' commentary across the region). Responding late is itself a sanctionable offense. Maximum fines approach 1.4 billion Chilean pesos for the gravest violations, and there's a public National Sanctions Registry.

Mexico dissolved the INAI and moved its powers to the Secretaría de Anticorrupción y Buen Gobierno, with more proactive enforcement and one change almost nobody read: ARCO rights now extend to automated decisions. If an algorithm denied credit or filtered out a candidate, the data subject can object and demand human review; your full privacy notice must explain the logic behind that decision (Executrain's LFPDPPP 2026 guide spells out the new notice requirements).

Those two changes stack on top of deadlines that already existed: Brazil answers art. 18 requests under the LGPD within 15 days (the ANPD handled 12,701 data subject requests in 2025 and opened 81 enforcement cases), and Colombia requires a response within 15 days under Ley 1581. The result is a deadline table no company can sustain with scattered emails:

The 6-stage framework: what a well-built rights workflow looks like

In our implementations, ARCO management stops being an email inbox and becomes a six-stage pipeline. It's the same pattern we use in the LGPD self-audit with n8n, but focused on the lifecycle of the data subject's request instead of the compliance snapshot.

1. Multi-channel intake. Web form, email, WhatsApp, or a mailbox on the site. The detail almost everyone misses: each channel needs its own record with exact date, time and request content, because the clock starts at receipt — and if there's a dispute, the authority will ask for that evidence.

2. Identity verification. This is where 90% of real abuse happens: anyone can request someone else's data. The workflow requires an accreditation mechanism matched to risk (security question, OTP, valid ID). In healthcare and finance this is non-negotiable.

3. Data location. The stage legal teams can't do alone. The workflow queries the data inventory (RAT) — or an index in your CRM — and answers "which systems hold this person's data and which fields belong to them." Without this, the request stalls and the deadline burns.

4. Draft generation. An AI step (OpenAI or Claude via API) drafts the response: what data is released, what's corrected, what's deleted, what's kept for legal obligations. A human validates — they don't write from scratch.

5. Execution and evidence. The workflow performs the action in the real systems — including deletion or anonymization in the database — and stores the record: who, when, which version of the data, under what legal basis. The evidence trail is the product, not an attachment.

6. Clock and escalation. Each request gets a deadline calculated per country. With 5 days left, the workflow notifies the owner; on expiry, it escalates to management with a trail. If the subject requested temporary blocking in Chile, the workflow treats that as 2 business days — not 30.

The numbers that justify building it (and the cost of not doing it)

We're not going to invent a fake ROI. Take an SMB with 20,000 CRM contacts and a couple of operational systems: if it receives 10 requests a month — the realistic average once the rights channel is published and actually works — each one currently eats 2 to 4 hours of a lawyer's or administrator's time, with deadline risk on top. That's 20 to 40 unbillable hours a month.

The n8n workflow described above, with the CRM as source of truth, costs what every automation we've published costs: self-hosted n8n ($6-20/month on a VPS), an AI API ($20-50/month) and the CRM you already pay for. That's under $70/month versus GRC systems or dedicated rights portals that start at tens of thousands of dollars in implementation in the Chilean market. And the benefit isn't just savings: at a healthcare client in Mexico, median response time went from "when the lawyer finds time" to a measurable 48 hours, with zero overdue requests in four months.

Build with n8n or buy a rights portal?

Good products exist — in Chile, platforms like ConSENT or Askesis already manage the request-deadline-evidence cycle — and for a large company processing thousands of requests a year, buying makes total sense. But for the Latin American SMB the comparison resolves quickly:

My position is direct: if you operate in one country with high volume, buy the specialized portal. If you operate in two or more countries — or process sensitive data — the modular workflow wins, because deadlines, channels and authorities differ per market, and a configuration table handles that better than a vertical product.

The mistake of believing AI solves compliance

One nuance, and I say it because we've seen it in production: AI doesn't answer ARCO requests — a deterministic workflow with AI helping at one specific point does. A chatbot telling the subject "we're handling your request" without locating their data or starting the clock is worse than not replying, because it creates expectation and a trail. The rule we apply in every implementation is the same one from our when not to use AI framework: what must be exact and auditable (deadlines, identity, evidence, deletion) stays in rules; what needs interpretation (drafting the response, classifying the request type) can go to the model. Separating those two worlds is the difference between a workflow that survives an audit and a pretty demo.

Where to start this week

If you want this ready before December — and in Chile's case, you have no choice — the order that works is: first, publish the rights request channel (dedicated form or email) and measure how many requests arrive; second, build the data index with your CRM as the base, because without knowing where the data lives there's no possible response; third, automate receipt and the clock before the AI draft. The full workflow, with n8n architecture, costs and a per-country checklist, is the same compliance pattern we've already documented for WhatsApp automation in regulated industries and for the LGPD self-audit. Starting with the clock — not the AI — is what separates the companies that will pay fines in 2027 from the ones that pass their first inspection with evidence.