Data Protection Workshop 1 · Task 1

Data Protection Fundamentals

Europe
European Union (GDPR) Germany Austria Spain Cyprus Malta Switzerland
Latin America
Peru Colombia Mexico Chile
Asia-Pacific
Singapore Malaysia

Jurisdiction selected: Colombia — Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015)

After this session you can

  • Tell personal, sensitive, pseudonymised and anonymised data apart
  • Explain processing and the roles of controller, processor and data subject
  • Name the core data protection principles and apply them to everyday work
  • Recognise data transfers to processors, other organisations and other countries
  • Describe the consequences of non-compliance for the organisation

Agenda

  • Personal data and anonymised data
  • Sensitive data
  • Processing and roles
  • The core principles
  • Lawful processing and consent
  • Data transfers
  • Consequences of non-compliance
  • Your jurisdiction at a glance
  • Check your understanding and next steps
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 1 of 10

Key Concept 1 — Personal Data

If you can tell who a piece of information is about, it is personal data.

Personal data is any information that relates to an identified or identifiable natural person. The definition is deliberately broad, and it is the same idea in almost every data protection law.

What counts as personal data?

  • Direct identifiers: name, ID or passport number, photo, e-mail address with a name
  • Indirect identifiers: customer or employee number, phone number, licence plate, IP address, device ID, cookie ID
  • Information about a person: salary, performance reviews, purchase history, location data, opinions about the person
  • Combinations: job title + department + location can point to one person, even without a name
  • Not personal data: data about companies (e.g. a company's turnover), truly anonymous statistics, and in most laws data about deceased persons

Pseudonymised or anonymised?

  • Identifiable data: "Maria López, customer 4711, bought a laptop" — fully covered by the law
  • Pseudonymised data: "Customer 4711 bought a laptop" — the key to re-identify the person still exists somewhere, so it is still personal data. Pseudonymisation is a good security measure, not an exit from the law.
  • Anonymised data: "35% of customers in Lima bought a laptop" — nobody can identify the person with reasonable effort, so the data falls outside data protection law
  • Rule of thumb: anonymisation must be irreversible. Small groups, rare attributes or linkable data sets often allow re-identification.
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 2 of 10

Key Concept 2 — Sensitive Data

Some data can cause serious harm if misused — the law protects it more strictly.

Sensitive data (also called special categories of personal data) can lead to discrimination, exclusion or other serious harm. The categories differ between laws, so always check your local list.

What is typically sensitive

  • Health data, including sick notes, disabilities and vaccination status
  • Racial or ethnic origin, religious and political beliefs
  • Trade union membership, sexual life and orientation
  • Genetic and biometric data, e.g. fingerprints for time recording
  • Often treated with similar care: criminal records, financial data, national ID numbers and data about children

What this means in practice: stricter conditions such as explicit or written consent, stronger security, access only for those who need it, and in many laws a risk assessment before you start.

Sensitive data in your jurisdiction

Colombia
  • Racial or ethnic origin
  • Political orientation
  • Religious or philosophical beliefs
  • Membership of trade unions, social or human rights organisations or political parties
  • Health and sexual life
  • Biometric data

Datos sensibles (Art. 5 Law 1581): data that affect privacy or could lead to discrimination. Data of children and adolescents also get special protection.

ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 3 of 10

Key Concept 3 — Processing and Roles

Almost everything you do with personal data is processing — and someone is responsible for it.

Processing covers the whole lifecycle: collecting, recording, storing, using, sharing, changing and deleting data, whether on paper or in IT systems. Every processing activity has clear roles.

The roles

  • Controller: decides why and how personal data is processed, and is accountable for compliance. Example: your company for its own customer and employee data.
  • Processor: processes personal data on behalf of and on the instructions of the controller. Example: a payroll provider, a cloud or IT service provider. A written contract is needed.
  • Data subject: the person the data is about — customers, employees, applicants, suppliers' contacts, website visitors.
  • Joint controllers: two organisations that decide the purposes together, e.g. a joint marketing campaign. They must agree who does what.
  • Tip: the role depends on the activity, not on the company. A provider can be processor for your data and controller for its own.

Local terms and scope

Colombia
  • Responsable del tratamiento (controller)
  • Encargado del tratamiento (processor)
  • Titular (data subject)

Law 1581 applies to personal data in databases processed in Colombia, and to processing abroad where Colombian law applies under international treaties. It protects natural persons.

ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 4 of 10

Key Concept 4 — The Core Principles

Seven principles that every processing activity must respect.

The names vary from law to law, but the ideas behind them are almost universal. The following workshops turn each principle into concrete measures.

The principles in plain words

  • Lawfulness, fairness and transparency: Have a legal basis, do not mislead people and tell them what you do with their data.
  • Purpose limitation: Collect data for clear purposes and do not reuse it for something incompatible.
  • Data minimisation: Collect only what you really need — no "just in case" fields.
  • Accuracy: Keep data correct and up to date; correct or delete wrong data.
  • Storage limitation: Keep data only as long as needed, then delete or anonymise it.
  • Security: Protect data against loss, theft and unauthorised access with technical and organisational measures.
  • Accountability: Be able to prove compliance: policies, records, assessments and evidence.

Principles as named in your law

Colombia
  • Legality (legalidad)
  • Purpose (finalidad)
  • Freedom (libertad)
  • Truthfulness or quality (veracidad o calidad)
  • Transparency (transparencia)
  • Restricted access and circulation (acceso y circulación restringida)
  • Security (seguridad)
  • Confidentiality (confidencialidad)
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 5 of 10

Principle in Focus — Lawfulness

No processing without a reason that the law accepts.

Lawfulness means that every processing activity needs a legal basis or a justification. Laws differ most in this point: some are built on consent, others offer several equal legal bases.

Typical legal bases and valid consent

  • Consent of the data subject, e.g. for newsletters
  • Contract: data needed to deliver what the customer ordered or to employ someone
  • Legal obligation: e.g. tax, accounting and social security records
  • Vital interests: e.g. medical emergencies
  • Legitimate interests of the organisation, balanced against the rights of the person (not available in every law)

Valid consent is freely given, specific, informed and unambiguous — and it can be withdrawn at any time. Pre-ticked boxes and consent hidden in terms and conditions do not count.

Legal basis in your jurisdiction

Colombia

Prior, express and informed authorisation of the data subject is the rule, and the controller must be able to prove it. Exceptions include legal or judicial orders, medical emergencies, public data and historical, statistical or scientific purposes.

ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 6 of 10

Key Concept 5 — Data Transfers

Data that leave your organisation need a reason — and data that leave the country need protection.

Personal data rarely stay inside one system: they go to service providers, group companies, partners and authorities, and very often to servers abroad. Each of these flows has its own rules.

Three kinds of transfers

  • To a processor that works on your behalf, e.g. payroll provider, cloud or IT support: a written contract with instructions, confidentiality and security is required.
  • To another controller that uses the data for its own purposes, e.g. insurer, bank, group company or authority: needs its own legal basis, and the data subjects must be informed.
  • Across borders: the destination country must offer adequate protection, or safeguards such as contractual clauses or group rules must be in place, unless an exception applies.

Easy to overlook: remote access from abroad (e.g. support teams or a parent company) and cloud services hosted outside the country count as transfers, too.

Transfers in your jurisdiction

Colombia

Colombian law distinguishes a transfer (transferencia) to another controller from a transmission (transmisión) to a processor, which needs a transmission contract. International transfers are only allowed to countries with an adequate level of protection according to the SIC, unless an exception applies (e.g. express authorisation of the data subject or a contract with them); otherwise, a declaration of conformity from the SIC is needed.

ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 7 of 10

Key Concept 6 — Consequences of Non-Compliance

Fines are only one of the risks — trust is often the bigger loss.

Most enforcement cases start with something avoidable: a security gap, a missing legal basis, an unanswered request from a customer or a complaint from an employee.

Typical consequences

  • Fines by the data protection authority, often based on turnover or on a fixed unit
  • Orders from authorities: stop a processing activity, delete data, change a system — which can halt a business process overnight
  • Claims for damages by the affected people, in some countries also through class actions or consumer associations
  • Loss of trust of customers, employees and business partners, and negative press
  • Business impact: lost tenders, failed due diligence and stricter requirements from customers
  • Personal liability of managers and employees under some laws

Sanctions in your jurisdiction

Colombia

Supervisory authority: Superintendence of Industry and Commerce (SIC), Delegation for the Protection of Personal Data

  • Fines of up to 2,000 monthly minimum wages (SMMLV)
  • Suspension of processing activities for up to six months
  • Temporary closure, or immediate and permanent closure of operations involving sensitive data
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 8 of 10

Your Jurisdiction at a Glance — Colombia

Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015)

Authority: Superintendence of Industry and Commerce (SIC), Delegation for the Protection of Personal Data

Requirements to remember

Colombia
  • Information processing policy (política de tratamiento de la información) is mandatory
  • Registration of databases in the National Database Registry (RNBD) for companies with total assets above 100,000 UVT
  • Security incidents reported to the SIC within 15 business days
  • Designated person or area to handle data subject requests

Where the programme covers them

  • Task 2 of this workshop: document Colombia in the data protection scope document, together with sector rules and other countries you operate in
  • Workshop 2: governance, roles and the data protection officer
  • Workshop 3: records of processing activities
  • Workshop 8 and 9: risk assessment and security measures
  • Workshop 10: vendors, processors and international transfers
  • Workshop 11: data breaches and notification deadlines
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 9 of 10

Check Your Understanding and Next Steps

Can everyone in the project team answer these questions?

Expected result of Task 1: all project team members understand the key data protection terms and principles that the following workshops build on.

Quick check

  • An Excel export lists employee numbers and sick days, but no names. Is this personal data? Is it sensitive?
  • Your payroll provider calculates salaries for you. Controller or processor?
  • Marketing wants to keep all leads "forever, just in case". Which principles are affected?
  • A report shows "2 customers of our smallest branch complained". Is it anonymous?
  • Your CRM runs on a cloud service hosted in another country. Is this a transfer, and what do you need?
  • Which authority supervises you in Colombia, and what is the maximum sanction?

Complete the task in ResGuard

  • Open Data Protection Workshop 1 in the Task Manager and select the task Data Protection Fundamentals
  • Attach evidence: participant list, these slides and the answers to the quick check
  • Record open questions as comments or new tasks with an owner
  • Set the task to completed
  • Next: Task 2 — Identify Applicable Data Protection Laws, starting with Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015)
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 10 of 10