Your Jurisdiction at a Glance — Colombia
Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015)
Authority: Superintendence of Industry and Commerce (SIC), Delegation for the Protection of Personal Data
- Information processing policy (política de tratamiento de la información) is mandatory
- Registration of databases in the National Database Registry (RNBD) for companies with total assets above 100,000 UVT
- Security incidents reported to the SIC within 15 business days
- Designated person or area to handle data subject requests
- Task 2 of this workshop: document Colombia in the data protection scope document, together with sector rules and other countries you operate in
- Workshop 2: governance, roles and the data protection officer
- Workshop 3: records of processing activities
- Workshop 8 and 9: risk assessment and security measures
- Workshop 10: vendors, processors and international transfers
- Workshop 11: data breaches and notification deadlines