The Superintendencia de Industria y Comercio (SIC) is Colombia's data protection authority, responsible for overseeing compliance with the country's personal data protection laws. As the SIC has expanded its enforcement activities in recent years, organisations operating in Colombia must take a proactive approach to compliance. This guide explains the SIC's role, the key compliance requirements and the practical steps your organisation should take to meet its obligations.
The SIC's Role as Data Protection Authority
The SIC is a government agency under the Ministry of Commerce, Industry and Tourism that exercises supervision and control over data protection matters in Colombia. Its Delegatura for Personal Data Protection is specifically tasked with ensuring compliance with Law 1581 of 2012 and its implementing regulations.
The SIC's data protection responsibilities include:
- Receiving and investigating complaints from data subjects regarding violations of their personal data rights
- Conducting inspections and audits of data controllers and processors
- Issuing binding orders to ensure compliance with data protection legislation
- Imposing administrative sanctions, including fines, for non-compliance
- Maintaining the National Database Registry (RNBD)
- Issuing guidance, circulars and regulations on data protection matters
- Promoting awareness of data protection rights and obligations
RNBD Registration Requirements
The Registro Nacional de Bases de Datos (RNBD) is a public registry managed by the SIC where all data controllers must register the databases they use to process personal data. This is one of the most distinctive features of Colombia's data protection regime and a key compliance obligation.
Who Must Register
All legal entities and natural persons acting as data controllers that process personal data in Colombia are required to register their databases with the RNBD. This applies to both private companies and public institutions, regardless of their size or the volume of data they process.
Registration Process
Registration is completed through the SIC's online platform. The process requires data controllers to provide detailed information about each database, including:
- The name and description of the database
- The types of personal data contained in the database (public, semi-private, private, sensitive)
- The purposes of data processing
- The categories of data subjects whose data is processed
- The security measures implemented to protect the data
- The data transfer and transmission policies, including any international transfers
- The channels available for data subjects to exercise their rights
Controllers must keep their RNBD registration up to date and report any significant changes to their databases or processing activities. Our Data Protection Manager helps organisations maintain accurate and current database records to support RNBD compliance.
The SIC's Single Circular on Data Protection
The SIC has consolidated its data protection guidance into the Single Circular (Circular Unica), which provides detailed instructions on compliance requirements. Key topics covered in the circular include:
- Privacy notices: Requirements for the content, format and delivery of privacy notices to data subjects
- Consent management: Guidelines for obtaining, documenting and managing consent for data processing
- Internal accountability programmes: Requirements for establishing comprehensive data protection programmes within organisations
- International data transfers: Conditions under which personal data may be transferred to other countries, including adequacy determinations and contractual safeguards
- Data breach management: Expectations for detecting, managing and reporting personal data breaches
Inspection and Investigation Powers
The SIC has broad investigative powers that enable it to monitor and enforce compliance effectively. Understanding these powers helps organisations prepare for potential regulatory scrutiny.
Complaint-Driven Investigations
The SIC investigates complaints filed by data subjects who believe their data protection rights have been violated. The complaint process begins with the data subject first raising the matter directly with the data controller. If the controller fails to respond adequately within the prescribed timelines, the data subject may escalate the complaint to the SIC.
Ex-Officio Investigations
The SIC may also initiate investigations on its own initiative, without a specific complaint. These proactive investigations may be triggered by media reports, sectoral reviews or the SIC's own monitoring activities. The SIC has conducted sector-wide sweeps targeting specific industries to assess compliance levels.
On-Site Inspections
SIC officials have the authority to visit an organisation's premises to review data processing activities, inspect documentation, interview staff and assess the effectiveness of security measures. Organisations must cooperate fully with SIC inspectors and provide access to all requested information.
Recent Enforcement Actions and Trends
The SIC has become increasingly active in enforcing data protection compliance. Notable enforcement trends include:
- Unsolicited marketing communications: The SIC has imposed sanctions on organisations that send marketing messages without obtaining prior consent from recipients
- Inadequate security measures: Organisations that fail to implement appropriate technical and administrative security measures have faced enforcement action
- Failure to respond to data subject requests: The SIC has sanctioned controllers that fail to respond to habeas data queries and claims within the prescribed timelines
- RNBD registration failures: Organisations that fail to register their databases or keep registrations up to date have been subject to penalties
- Unlawful international data transfers: The SIC has investigated cases where personal data was transferred to countries without adequate protection and without proper safeguards
Penalties and Sanctions
The SIC may impose a range of sanctions for violations of data protection law:
- Fines: Up to 2,000 times the current legal monthly minimum wage per violation. Given the current minimum wage levels, this can represent significant financial exposure
- Suspension of processing: The SIC may order the temporary suspension of data processing activities that are found to violate the law
- Database closure: In cases of persistent non-compliance, the SIC may order the permanent closure of a database
- Public sanctions: The SIC may publish details of enforcement actions, which can cause significant reputational damage
Privacy Impact Assessments
While Colombian law does not explicitly mandate privacy impact assessments (PIAs) in the same way as the GDPR requires Data Protection Impact Assessments, the SIC strongly recommends that organisations conduct PIAs as part of their accountability programmes. A PIA helps identify and mitigate privacy risks associated with new projects, technologies or processing activities.
A thorough PIA should assess the necessity and proportionality of the processing, identify potential risks to data subjects, evaluate existing controls and recommend additional measures where necessary. Incorporating PIAs into your project lifecycle demonstrates a proactive approach to compliance that the SIC views favourably.
Internal Accountability Programme Requirements
The SIC expects organisations to implement a comprehensive internal accountability programme (Programa Integral de Gestion de Datos Personales) that demonstrates their commitment to data protection compliance. Key elements include:
- Organisational commitment: Senior management must demonstrate visible support for data protection, including allocating adequate resources
- Internal policies and procedures: Documented policies covering all aspects of data processing, from collection to deletion
- Risk management: Processes for identifying, assessing and mitigating data protection risks
- Training and awareness: Regular awareness training programmes for all employees who handle personal data
- Incident response: Documented procedures for detecting, managing and reporting data breaches
- Monitoring and review: Regular audits and reviews to assess the effectiveness of the accountability programme
- Documentation: Comprehensive records that evidence compliance activities and decisions
Practical Steps to Achieve SIC Compliance
Organisations can follow these steps to establish and maintain compliance with SIC requirements:
- Assess your current state: Conduct a gap analysis comparing your current practices against the requirements of Law 1581, Decree 1377 and the SIC's Single Circular
- Register with the RNBD: Ensure all databases containing personal data are registered and that registration information is accurate and current
- Develop your accountability programme: Create a comprehensive data protection programme that addresses all elements expected by the SIC
- Review consent mechanisms: Verify that consent is obtained properly for all processing activities and that records of consent are maintained
- Implement security measures: Deploy appropriate technical and organisational measures to protect personal data from unauthorised access, loss or destruction
- Establish request handling procedures: Create workflows for responding to habeas data queries and claims within the required timelines
- Prepare for inspections: Maintain organised documentation that can be readily provided to SIC officials during an inspection
- Engage expert support: Consider working with an outsourced DPO or data protection consultancy to ensure your programme meets all regulatory expectations
Conclusion
SIC compliance is an ongoing obligation that requires continuous attention and investment. As Colombia's data protection authority becomes more active in enforcement, organisations that take a proactive approach to compliance will be better positioned to avoid penalties and build trust with their stakeholders. By registering with the RNBD, implementing a robust accountability programme, training staff and maintaining comprehensive documentation, your organisation can demonstrate its commitment to data protection and meet the SIC's expectations with confidence.