Processes personal data, in Colombia

Resolución 1995 de 1999 del Ministerio de Salud, arts. 1(a), 2, 14 y 18 (Reserva y Acceso a la Historia Clinica) · Read the law's page

• Treat the clinical history as a private document subject to confidentiality, and let a third party know it only with the patient's prior authorization or in the cases the law provides.
• Give access to the information in the clinical history only to the user, the health team, judicial and health authorities in the cases the law provides, and the other persons the law determines, and only for purposes the law makes proper.
• Protect the confidentiality of the clinical history with mechanisms that block access by unauthorized staff, and take measures against accidental or deliberate destruction of the records.
• Give automated clinical-history programs, equipment and document supports security mechanisms that make it impossible to alter the clinical history once the data is recorded and saved.
• Make it possible to identify the staff member responsible for each entry, by codes, indicators or other means in place of a signature and stamp, with the exact time and date of the entry.

Ley Estatutaria 1266 de 2008, arts. 10 paragrafo 2, 12 y 13 (Comunicacion Previa, Permanencia de la Informacion y Consulta Gratuita) · Read the law's page

• Before a source reports negative information on an unpaid obligation to a data bank operator, send the data subject a prior communication so the data subject can pay, or dispute the amount or the due date; report only after twenty calendar days from sending it to the last registered address.
• Where a negative report was made without the prior communication and the obligation was already extinguished, withdraw the negative report at once; where it was not extinguished, withdraw the report and send the communication before reporting again.
• For an obligation of 15 percent of one monthly legal minimum wage or less, report negative data only after at least two communications on different days, with twenty calendar days between the last communication and the report.
• Keep positive information in the data bank indefinitely, and remove information on a default so that users can no longer consult it once twice the length of the default has passed, up to a maximum of four years from payment or extinction of the obligation.
• Delete negative data on a default from the database eight years after the obligation fell into default.
• Update scores and any other financial, commercial or credit measure at the same time as the negative data is withdrawn or the fact that lowered the measure ends.
• Let the data subject consult the financial, credit, commercial and service information free of charge on every occasion and by every means, and do not lower the data subject's risk rating or score because of repeated review.
• Do not consult financial, credit, commercial and service information for employment decisions, and do not use it for purposes other than analysing or calculating the data subject's credit risk.

Ley Estatutaria 1266 de 2008, arts. 17 y 18 (Funcion de Vigilancia y Sanciones) · Read the law's page

• Comply with the instructions and orders of the Superintendencia de Industria y Comercio, or of the Superintendencia Financiera de Colombia where you are an entity it supervises, on how to administer financial, credit, commercial, service and third-country information.
• Carry out the external systems audit the supervisory authority orders at your cost to verify compliance.
• Comply with the authority's order to correct, update or withdraw personal data, which it may give on its own initiative or on a data subject's request after the claim to the operator or source went unanswered or was answered unfavorably.
• Accept administrative fines of up to 2,000 current monthly legal minimum wages, which may be imposed successively while the violation continues, suspension of the data bank's activities for up to six months for a serious violation, and closure of the operation; a data bank that administers prohibited data is closed immediately and permanently.

Ley Estatutaria 1266 de 2008, arts. 2, 6 y 16 (Derechos de los Titulares y Peticiones, Consultas y Reclamos) · Read the law's page

• Answer a data subject's request to consult the personal data held in your data bank within ten business days of receipt; if you cannot, tell the data subject the reasons and the date, which may not be more than five business days after the first term ends.
• Answer a data subject's claim to correct or update data within fifteen business days from the day after receipt; if you cannot, tell the data subject the reasons and the date, which may not be more than eight business days after the first term ends.
• As a data bank operator, add to the individual record, within two business days of receiving a complete claim, a legend reading reclamo en trámite with the nature of the claim, keep it until the claim is decided and include it in the information you give to users.
• Where an independent source of the information exists, pass the claim to the source within two business days; the source must resolve it and answer the operator within ten business days, and the operator must answer the data subject within fifteen business days, extendable by eight.
• Check fully the data subject's observations and all the pertinent information before answering a claim.
• Treat a petition or claim left unresolved within the deadline as accepted, and let the data subject ask the Superintendencia de Industria y Comercio or the Superintendencia Financiera de Colombia to impose sanctions.

Ley Estatutaria 1266 de 2008, arts. 3(c), 4(c), 7 y 11 (Operadores de Bancos de Datos de Informacion Crediticia) · Read the law's page

• Adopt an internal manual of policies and procedures to ensure compliance with the law, above all for handling data subjects' queries and claims.
• Keep the stored records securely to prevent their deterioration, loss, alteration or unauthorized or fraudulent use.
• Let only the persons the law allows access the information, and circulate it to users only within the limits of the law.
• Where the law makes the data subject's authorization necessary, ask the source for a certification that the authorization exists.
• Update and correct the data each time the sources report changes.
• Do not make personal data in the data bank, other than public information, accessible on the internet or by other mass media unless access is technically controllable so that only data subjects or authorized users can see it.
• If you operate independently of the sources, be set up as a commercial company, a non-profit entity or a cooperative; keep a service area for data subjects' petitions, queries and claims; keep a security system and technical conditions that prevent adulteration, loss, and unauthorized consultation or use of the records; and update the information the sources report at intervals of no more than ten calendar days from receiving it.
• Comply with the instructions and requirements the supervisory authority gives on compliance with the law.

Ley 1581 de 2012, arts. 17(n), 18(k) (Notificacion de Violaciones de Seguridad) · Read the law's page

• Notify the Superintendencia de Industria y Comercio when a violation of the security codes occurs and creates a risk in the administration of a data subject's personal information.
• As a data processor, notify the Superintendencia de Industria y Comercio under the same terms when a security code violation creates that risk; neither duty requires telling the affected data subject directly.

Ley 1581 de 2012, arts. 19-24 (Autoridad y Sanciones) · Read the law's page

• Expect the Superintendencia de Industria y Comercio to investigate a violation on its own initiative or on complaint and to order the measures needed to make the habeas data right effective, including access, rectification, updating or deletion of the data at issue.
• Expect the Superintendencia de Industria y Comercio to temporarily block your processing of a data subject's information where the evidence shows a real risk to their fundamental rights, until it reaches a final decision.
• Comply with an administrative fine of up to 2,000 current monthly legal minimum wages, a suspension of your processing activity for up to six months, or the immediate and permanent closure of an operation involving sensitive data, imposed by the Superintendencia de Industria y Comercio for violating this law; these sanctions apply only to private parties, and a public authority's violation goes to the Procuraduria General de la Nacion instead.

Ley 1581 de 2012, arts. 26-27 (Transferencia a Terceros Paises) · Read the law's page

• Do not transfer personal data to a country the Superintendencia de Industria y Comercio has not found to offer an adequate level of data protection, absent a recognized exception.
• Rely on the cross border transfer exceptions only where the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical exchange required for treatment or public health, a banking or securities transfer under its own law, a transfer under a reciprocal international treaty Colombia has joined, a transfer necessary to perform a contract with the data subject, or a transfer legally required to safeguard the public interest or defend a right in a judicial proceeding.
• Where none of the listed exceptions applies, obtain the Superintendencia de Industria y Comercio's declaration of conformity before transferring personal data internationally.

Ley 1581 de 2012, arts. 5-7 (Datos Sensibles y Menores) · Read the law's page

• Before processing sensitive personal data, including data revealing racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, or biometric data, obtain the data subject's explicit authorization; processing sensitive personal data is otherwise prohibited.
• Process sensitive personal data without the data subject's explicit authorization only where it protects the data subject's vital interest and they cannot consent, where a not for profit political, philosophical, religious or union body processes it about its own members without disclosing it to third parties, where it is needed to establish, exercise or defend a right in a judicial proceeding, or where it serves a historical, statistical or scientific purpose and the data subject's identity is suppressed.
• Do not process a child's or adolescent's personal data unless it is data of a public nature, and provide children, adolescents and their guardians with information and training on the risks of improper processing and on the safe, responsible use of their personal data.

Ley 1581 de 2012, arts. 8, 12, 14-16 (Derechos de los Titulares) · Read the law's page

• Give a data subject the right to know, update and rectify their personal data, request proof of the authorization given, be told on request how their data has been used, revoke the authorization or seek deletion where the processing violates their constitutional or statutory rights, and access their personal data free of charge.
• Before requesting a data subject's authorization, tell them clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, their rights as a data subject, and how to identify and contact you, and keep proof that you gave this notice.
• Answer a data subject's request to consult their personal data within ten business days, or tell them the reason for delay and a new date no more than five business days later.
• Mark the record with a pending claim legend within two business days of receiving a complete claim for correction, updating or deletion, and resolve the claim within fifteen business days, or fifteen days extendable by eight more days with notice of the delay and a new resolution date.
• Expect a data subject to complain to the Superintendencia de Industria y Comercio only after they have exhausted the consultation or claim procedure with you.

Ley Estatutaria 1581 de 2012, arts. 1-4, 9-11, 13, 17-18, 25, 28-30 (Objeto, Principios, Autorizacion y Deberes Generales) · Read the law's page

• Obtain the data subject's prior, explicit and informed authorization before collecting or processing their personal data, unless a statutory exception applies.
• Apply the legality, purpose limitation, freedom, accuracy, transparency, restricted access and confidentiality principles to every processing operation, and do not process partial, incomplete, fragmented or misleading personal data.
• Keep proof of the data subject's authorization, tell them at authorization the purpose of the processing, keep their personal data updated and accurate, secure it against unauthorized alteration, loss, consultation, use or access, and correct it once it is shown to be incorrect.
• As a data processor, keep personal data secure in the same way, update or correct it as the controller instructs within five business days, and adopt an internal manual of policies and procedures for handling consultations and claims.
• Share personal data only with the data subject or their representatives, a public authority acting within its legal functions or under court order, or a third party the data subject or the law has authorized, and supply any information you owe them in an easily readable format matching what is on file.
• Register your databases with the Superintendencia de Industria y Comercio's National Registry of Databases and submit data treatment policies that never fall below this law's duties.

Decreto 1074 de 2015, arts. 2.2.2.25.1.2, 2.2.2.25.2.1, 2.2.2.25.2.2, 2.2.2.25.2.4, 2.2.2.25.2.5, 2.2.2.25.2.8, 2.2.2.25.3.1 a 2.2.2.25.3.5 (Autorizacion y Politicas de Tratamiento) · Read the law's page

• Collect only the personal data that is pertinent and adequate for the purpose of collection, and collect none without the data subject's authorization except where the law expressly provides; do not use deceptive or fraudulent means to collect or process personal data.
• Adopt procedures to request the data subject's authorization no later than the moment of collection, and tell the data subject which personal data will be collected and every specific purpose of the processing.
• Treat authorization as given only by a written statement, an oral statement or unequivocal conduct of the data subject; silence is never unequivocal conduct; keep proof of each authorization.
• Tell data subjects of a substantial change to the processing policy, on who the controller is or the purpose of the processing, before or at the latest when the change is implemented, and obtain a new authorization when the purpose changes.
• Collect, store, use or circulate personal data only for the time that is reasonable and necessary for the purposes of the processing, delete it once the purposes are met unless a legal or contractual duty requires keeping it, and document the procedures for processing, keeping and deleting it.
• Develop a processing policy in a physical or electronic medium, in clear and simple language, that states at least the controller's name and contact details, the processing and its purpose, the data subject's rights, who handles requests, the procedure for exercising the rights and the policy's effective date and the database's period of validity, and see that processors follow it.
• Where the policy cannot be made available to the data subject, give a privacy notice at the latest when the data is collected, stating the controller's name and contact details, the processing and its purpose, the data subject's rights and how to reach the policy; keep the notice model for as long as personal data is processed under it.

Decreto 1074 de 2015, arts. 2.2.2.25.2.3 y 2.2.2.25.2.9 (Datos Sensibles y Datos de Ninos, Ninas y Adolescentes) · Read the law's page

• Do not process sensitive personal data except in the cases article 6 of Ley 1581 de 2012 expressly lists.
• Where processing sensitive data is allowed, tell the data subject that they are not obliged to authorize it; tell them explicitly and beforehand, besides the general requirements of authorization, which of the data to be processed are sensitive and the purpose of the processing; and obtain their express consent.
• Do not condition any activity on the data subject supplying sensitive personal data.
• Do not process the personal data of children and adolescents except data of a public nature; where processing is allowed it must respond to and respect the child's best interests and ensure respect for their fundamental rights.
• Obtain the authorization from the child's legal representative only after the child has been able to exercise the right to be heard, weighing the child's opinion by their maturity, autonomy and capacity to understand the matter.

Decreto 1074 de 2015, arts. 2.2.2.25.2.6, 2.2.2.25.3.6 y 2.2.2.25.4.1 a 2.2.2.25.4.4 (Ejercicio de los Derechos de los Titulares) · Read the law's page

• Let a data subject ask at any time for deletion of their personal data or revocation of the authorization by filing a claim; do not grant the request when the data subject has a legal or contractual duty to remain in the database.
• Provide free and easily accessible means for the data subject to ask for deletion or revocation.
• Accept requests from the data subject, who must prove their identity sufficiently, from their heirs, from their representative or attorney, and by stipulation in favor of another; the rights of children and adolescents are exercised by those who may represent them.
• Provide simple and agile mechanisms, permanently available, for data subjects to access the personal data you control; let the data subject consult it free of charge at least once each calendar month and whenever the processing policies change substantially.
• For more frequent consultations, charge only the costs of shipping, reproduction and certification of documents, never above the cost of recovering the material, and prove those costs to the Superintendencia de Industria y Comercio when it asks.
• Take reasonable measures so that the personal data you hold is accurate and sufficient, and update, rectify or delete it when the data subject asks or when you could have noticed the need.
• Designate a person or area to handle data subjects' requests, and make the procedures for access, update, deletion, rectification and revocation known or easily accessible to data subjects and part of the processing policy.

Decreto 1074 de 2015, arts. 2.2.2.25.5.1 y 2.2.2.25.5.2 (Transferencia y Transmision Internacional de Datos Personales) · Read the law's page

• Observe article 26 of Ley 1581 de 2012 for every international transfer of personal data to a recipient that is itself a controller.
• For an international transmission to a processor acting on your behalf, sign a contract that sets the scope of the processing, the activities the processor performs for you and its obligations to the data subject and to you; with such a contract in place the transmission needs neither notice to the data subject nor the data subject's consent.
• Include in the contract the processor's obligations to process the data under the principles that protect it, to safeguard the security of the databases that hold it and to keep the data confidential.

Decreto 1074 de 2015, arts. 2.2.2.25.6.1 y 2.2.2.25.6.2 (Responsabilidad Demostrada) · Read the law's page

• Be able to demonstrate to the Superintendencia de Industria y Comercio, at its request, that you have implemented appropriate and effective measures to comply with Ley 1581 de 2012 and its regulating chapter, in proportion to your legal nature and size, the nature of the data, the type of processing and the risks to data subjects.
• Answer the Superintendencia's request with a description of the procedures you use to collect, store, use, circulate and delete personal data, the purposes of the collection and an explanation of why each kind of data is needed, and with evidence that you have effectively implemented appropriate security measures.
• Keep internal policies that guarantee an administrative structure proportionate to your size, internal mechanisms including tools, training and education programs, and processes for answering data subjects' queries, requests and claims.

Decreto 1074 de 2015, arts. 2.2.2.26.1.1 a 2.2.2.26.3.4 (Registro Nacional de Bases de Datos) · Read the law's page

• If you are a company or non-profit entity with total assets above 100,000 UVT, or a public legal entity, register each database that contains personal data you process in the Registro Nacional de Bases de Datos, each one separately.
• Register a database created after the registration deadlines within two months of its creation.
• Register at least the controller's and any processor's identification and contact data, the channels for data subjects to exercise their rights, the name and purpose of the database, whether processing is manual or automated, and the processing policy; registering the policy does not excuse making it known to data subjects.
• Update the registration when the Superintendencia de Industria y Comercio defines a change as substantial.

SIC Circular Externa 3 de 2018, incidentes de seguridad (numeral 2.1(f)(ii) of Capítulo Segundo, Título V of the Circular Única) · Read the law's page

• If you are a controller that must register your databases in the national database registry (RNBD), report each security incident that affects a database you administer or your processor administers to that registry within 15 business days after you detect it and the person or area responsible for handling it learns of it.
• If you are a controller that need not register your databases, or a processor, report each security incident that affects the information in your databases to the Superintendencia de Industria y Comercio through its online application or another channel it enables, within the same 15 business days.

SIC Circular Externa 3 de 2018, información adicional del RNBD (numeral 2.1(a)-(f)(i) of Capítulo Segundo, Título V of the Circular Única) · Read the law's page

• If you are a company or non-profit entity with total assets above 100,000 UVT, or a public legal entity, register in the national database registry (RNBD), beside what Chapter 26 of Decreto 1074 de 2015 requires, the classification of the personal data stored in each database, grouped by categories and subcategories according to their nature.
• Register the information security controls you have implemented for each database, answering the questions the registry sets.
• Register whether the personal data in each database was collected from the data subject or supplied by third parties, and whether authorization or an exemption under article 10 of Ley 1581 de 2012 covers the processing.
• Register each international transfer of personal data with the recipient controller, its country, and whether a declaration of conformity or an exception under article 26 of Ley 1581 de 2012 covers it.
• Register each international transmission of personal data with the recipient processor, its country, and whether a transmission contract or a declaration of conformity covers it.
• Report, for each calendar half-year (January to June and July to December), the claims data subjects filed with you or your processor, by the claim types preset in the registry.

Decreto 1074 de 2015, arts. 2.2.2.25.7.1 a 2.2.2.25.7.8 (Normas Corporativas Vinculantes) · Read the law's page

• If you are a business group that transfers personal data from Colombia to a controller of the group outside Colombia, comply with the Binding Corporate Rules that bind every member of the group, unless the group applies another transfer mechanism that Colombian law establishes.
• Make the Binding Corporate Rules ensure that the group processes data lawfully, fairly and transparently, for specified, explicit and legitimate purposes, limited to what is necessary, accurately and kept up to date, and kept in identifiable form no longer than necessary, and that the rules secure the principles of article 4 of Ley 1581 de 2012, the special categories of data, the data subject's rights and the controller's duties.
• Submit the Binding Corporate Rules to the Superintendencia de Industria y Comercio only after the competent corporate body has approved them; they apply only from the date the Superintendencia issues its certification.
• Once the Binding Corporate Rules are approved, say so on the group's website.
• Accept that every group company and member is jointly liable for compliance with the Binding Corporate Rules.

SIC Circular Externa 002 de 2024, Decreto 1074 de 2015 art. 2.2.2.25.6.1 (Responsabilidad Demostrada) · Read the law's page

• Be ready to demonstrate to the Superintendencia de Industria y Comercio, on its request, that you have implemented measures that are appropriate and effective to comply with Ley 1581 de 2012 and Decreto 1074 de 2015 for any artificial intelligence system that processes personal data.

SIC Circular Externa 002 de 2024, instrucciones I, II, VIII-IX (Lineamientos sobre Tratamiento de Datos en Sistemas de IA), 21 de agosto de 2024 · Read the law's page

• Before collecting personal data from the internet to develop, train, test or deploy an artificial intelligence system, obtain the data subject's prior, express and informed authorization; a datum being accessible online does not make it a public datum exempt from that requirement.
• Weigh whether processing personal data in an artificial intelligence system is suitable to the goal pursued, necessary because no less intrusive measure achieves it equally well, reasonable because it serves a constitutional purpose, and proportionate because its benefits are not outweighed by the harm to the right to data protection.
• Where you cannot be certain an artificial intelligence system's processing will not cause serious, irreversible harm, refrain from that processing or adopt precautionary measures, and adapt your risk management systems to identify, measure, control and monitor the situations that could affect your compliance with personal data protection rules.
• Complete and document a privacy impact assessment before an artificial intelligence system likely to pose a high risk to data subjects processes their personal data, covering the processing operations, a risk evaluation, and the measures planned to prevent the risks identified.
• Only process truthful, complete, exact, updated, verifiable and understandable personal data in an artificial intelligence system, and do not process partial, incomplete, fragmented or misleading personal data.
• Apply privacy by design and by default, including techniques such as differential privacy, so that data used to train an artificial intelligence system does not allow the person who provided it to be identified.
• Adopt technological, human, administrative, physical and contractual security measures to prevent unauthorized access to, manipulation, destruction, or unauthorized use or circulation of personal data processed in an artificial intelligence system, and keep those measures auditable by the authorities.

SIC Circular Externa 002 de 2024, instrucciones VII, X (Derechos de los Titulares en Sistemas de IA) · Read the law's page

• Let a data subject obtain, at any time and without restriction, information about how an artificial intelligence system is processing their personal data.
• Put in place pertinent, efficient and demonstrable strategies for an artificial intelligence system to guarantee the data subject rights that Ley 1266 de 2008 and Ley 1581 de 2012 and their implementing decrees establish.

Constitución Política de Colombia (1991), art. 15 (Intimidad y Habeas Data) · Read the law's page

• Let a person know, update and correct the information collected about them in your databases and archives, whether you are a public or a private entity.