ColombiaDecreto 1074 de 2015, Exercise of Data Subject Rights
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Let a data subject ask at any time for deletion of their personal data or revocation of the authorization by filing a claim; do not grant the request when the data subject has a legal or contractual duty to remain in the database.
- Provide free and easily accessible means for the data subject to ask for deletion or revocation.
- Accept requests from the data subject, who must prove their identity sufficiently, from their heirs, from their representative or attorney, and by stipulation in favor of another; the rights of children and adolescents are exercised by those who may represent them.
- Provide simple and agile mechanisms, permanently available, for data subjects to access the personal data you control; let the data subject consult it free of charge at least once each calendar month and whenever the processing policies change substantially.
- For more frequent consultations, charge only the costs of shipping, reproduction and certification of documents, never above the cost of recovering the material, and prove those costs to the Superintendencia de Industria y Comercio when it asks.
- Take reasonable measures so that the personal data you hold is accurate and sufficient, and update, rectify or delete it when the data subject asks or when you could have noticed the need.
- Designate a person or area to handle data subjects' requests, and make the procedures for access, update, deletion, rectification and revocation known or easily accessible to data subjects and part of the processing policy.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
The articles require mechanisms for exercising rights, a designated person or area and cost evidence on request. They set no log, record of requests or keeping period, so the row records no logging duty. The articles cited here carry no territorial scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on . A data subject may at any time ask the controller or processor to delete their data or revoke the authorization by filing a claim, and the request does not succeed when the data subject has a legal or contractual duty to remain in the database.
A data subject may consult their personal data free of charge at least once each calendar month and whenever the processing policies change substantially. For consultations more frequent than once a calendar month, the controller may charge only the costs of shipping, reproduction and certification of documents, which may not exceed the cost of recovering the material. Every controller and processor must designate a person or area to handle data subjects' requests to exercise their rights.
The procedures for access, update, deletion, rectification and revocation of authorization must be made known or be easily accessible to data subjects and be included in the processing policy.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .