Is an insurer, in Bolivia

Ley No. 393 de Servicios Financieros, art. 477 (Acción de Protección de la Privacidad) · Read the law's page

• If you are a financial entity, let a person know, object to, and obtain the deletion or rectification of data you have registered about them in physical, electronic, magnetic or computer-based files and databases, which they may enforce through the Acción de Protección de la Privacidad (Ley 393, Article 477).

Ley No. 393 de Servicios Financieros, arts. 346, 348, 349 and 350 (Burós de Información) · Read the law's page

• If you run a credit information bureau (buró de información) authorized by Bolivia's financial supervisor ASFI, take effective security and control measures at all times to prevent improper use or handling of the information you hold (Ley 393, Article 350).
• Do not solicit, collect or provide information for purposes other than your bureau business, and do not collect information from sources the supervisor's rules do not permit (Ley 393, Article 348(c) and (d)).
• Do not improperly alter, change on your own initiative or delete records in databases that come from ASFI or other authorized sources, and do not transfer to third parties, free or for a price, the information you receive from ASFI, except what relates to supplying information within your purpose (Ley 393, Article 348(e) and (f)).
• Give ASFI unrestricted, free access to all the information you manage, through access to your systems or periodic reports (Ley 393, Article 349).

Reglamento para la Gestión de Seguridad de la Información, Recopilación de Normas para Servicios Financieros, Libro 3, Título VII, Capítulo II, Secciones 1, 3, 9, 12 y 13 · Read the law's page

• This binds an entidad de intermediación financiera (EIF), an empresa de servicios financieros complementarios (ESFC) other than a currency exchange house (casa de cambio), and a sociedad controladora de grupos financieros (SCGF) that holds an operating license from the Autoridad de Supervisión del Sistema Financiero (ASFI), reached by declaring that you provide financial services.
• Meet the minimum directives and requirements the Regulation sets for information security management, according to your nature, size and structure and the complexity of your processes and operations (Section 1, Article 1).
• Analyze and evaluate your information security risks under formally established procedures that match your nature, size and operational complexity (Section 3, Article 1).
• Run a technical vulnerability management program with formal policies and procedures, assess technical vulnerabilities at least once a year and after a change in your technological infrastructure, and include controlled intrusion tests where your risk analysis calls for them (Section 3, Article 8).
• Have a formalized, updated and implemented procedure for managing information security incidents, approved by your board or equivalent body, that fixes responsibilities and procedures for a rapid, effective and orderly response (Section 9).
• Keep a database that records each information security incident under a classification that covers at least the sixteen categories Section 9 lists, from loss of service to repeated attempts at unauthorized access (Section 9, items c and d).
• Have your internal audit function verify compliance with the Regulation for the preceding twelve months, and send ASFI the resulting report by 15 January each year (Section 12, item a).
• Make your board or equivalent body and your general management responsible for compliance with, implementation of and internal dissemination of the Regulation (Section 13, Article 1).
• Apply international information technology and information security standards to any situation the Regulation does not foresee, and name the standards you use in your policies (Section 13, Article 2).

Reglamento para la Gestión de Seguridad de la Información, Recopilación de Normas para Servicios Financieros, Libro 3, Título VII, Capítulo II, Sección 12, Artículo Único, inciso b · Read the law's page

• This binds an entidad de intermediación financiera (EIF), an empresa de servicios financieros complementarios (ESFC) other than a currency exchange house (casa de cambio), and a sociedad controladora de grupos financieros (SCGF) that holds an operating license from the Autoridad de Supervisión del Sistema Financiero (ASFI), reached by declaring that you provide financial services.
• Assess your technical vulnerabilities at least once a year and after a change in your technological infrastructure, using controlled intrusion tests where your risk analysis calls for them (Section 3, Article 8, item a).
• Have your internal audit function report on the execution of the intrusion tests and send ASFI the result of the vulnerability analysis by 15 November each year, attaching a copy of the evaluator's executive report and the action plan that corrects the weaknesses found (Section 12, item b).