ColombiaDecreto 1074 de 2015, Authorization, Retention and Processing Policy Rules (Ley 1581 Regulations)
Decreto 1074 de 2015 arts. 2.2.2.25.1.2, 2.2.2.25.2.1, 2.2.2.25.2.2, 2.2.2.25.2.4, 2.2.2.25.2.5, 2.2.2.25.2.8, 2.2.2.25.3.1 a 2.2.2.25.3.5 (Autorizacion y Politicas de Tratamiento)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Retention, Governance
- Audit expectation
- none
What it requires
- Collect only the personal data that is pertinent and adequate for the purpose of collection, and collect none without the data subject's authorization except where the law expressly provides; do not use deceptive or fraudulent means to collect or process personal data.
- Adopt procedures to request the data subject's authorization no later than the moment of collection, and tell the data subject which personal data will be collected and every specific purpose of the processing.
- Treat authorization as given only by a written statement, an oral statement or unequivocal conduct of the data subject; silence is never unequivocal conduct; keep proof of each authorization.
- Tell data subjects of a substantial change to the processing policy, on who the controller is or the purpose of the processing, before or at the latest when the change is implemented, and obtain a new authorization when the purpose changes.
- Collect, store, use or circulate personal data only for the time that is reasonable and necessary for the purposes of the processing, delete it once the purposes are met unless a legal or contractual duty requires keeping it, and document the procedures for processing, keeping and deleting it.
- Develop a processing policy in a physical or electronic medium, in clear and simple language, that states at least the controller's name and contact details, the processing and its purpose, the data subject's rights, who handles requests, the procedure for exercising the rights and the policy's effective date and the database's period of validity, and see that processors follow it.
- Where the policy cannot be made available to the data subject, give a privacy notice at the latest when the data is collected, stating the controller's name and contact details, the processing and its purpose, the data subject's rights and how to reach the policy; keep the notice model for as long as personal data is processed under it.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 2.2.2.25.2.5 requires the controller to keep proof of the authorization each data subject gave for the processing of their data. It sets no keeping period beyond that, no format or contents, and names no body that may demand the proof. The articles cited here carry no scope clause beyond the personal or domestic exclusion, so no territorial hook is recorded.
- Kind
- Explicit
- As of
- Provision
- Decreto 1074 de 2015, art. 2.2.2.25.2.5
- Trigger
- consent_or_optout
What this law does
Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on . The chapter does not apply to databases kept in an exclusively personal or domestic setting. Silence is never treated as unequivocal conduct that gives authorization. A controller must keep proof of each authorization a data subject gave for the processing of their data.
Once the purposes of the processing are met, the controller and the processor must delete the personal data they hold, unless a legal or contractual duty requires keeping it. A processing policy must be in a physical or electronic medium, in clear and simple language, and be made known to data subjects. Where the policy cannot be made available to the data subject, the controller must inform the data subject of it by a privacy notice at the latest when the data is collected.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .