ColombiaDecreto 1074 de 2015, Sensitive Data and Children's Data Rules
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not process sensitive personal data except in the cases article 6 of Ley 1581 de 2012 expressly lists.
- Where processing sensitive data is allowed, tell the data subject that they are not obliged to authorize it; tell them explicitly and beforehand, besides the general requirements of authorization, which of the data to be processed are sensitive and the purpose of the processing; and obtain their express consent.
- Do not condition any activity on the data subject supplying sensitive personal data.
- Do not process the personal data of children and adolescents except data of a public nature; where processing is allowed it must respond to and respect the child's best interests and ensure respect for their fundamental rights.
- Obtain the authorization from the child's legal representative only after the child has been able to exercise the right to be heard, weighing the child's opinion by their maturity, autonomy and capacity to understand the matter.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 2.2.2.25.2.3 and 2.2.2.25.2.9 prohibit processing outside the stated cases and set conditions on authorization. They name no log or keeping period; the proof of authorization sits in another row and is not read into this one. The articles cited here carry no territorial scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on . Processing of sensitive data is prohibited except in the cases expressly listed in article 6 of Ley 1581 de 2012. Where processing sensitive data is allowed, the controller must tell the data subject that they are not obliged to authorize it. No activity may be conditioned on the data subject supplying sensitive personal data.
Processing of the personal data of children and adolescents is prohibited except for data of a public nature, and the processing must respond to and respect the child's best interests and ensure respect for their fundamental rights. The legal representative gives the authorization after the child has exercised the right to be heard, and the child's opinion is weighed by their maturity, autonomy and capacity to understand the matter.
When LexLint raises it
When your app profile says your app processes personal data or serves under-18s.
Back to the example · Lint your app
Page updated .