ColombiaDecreto 1074 de 2015, Demonstrated Accountability Before the Superintendencia
Decreto 1074 de 2015, arts. 2.2.2.25.6.1 y 2.2.2.25.6.2 (Responsabilidad Demostrada)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Superintendencia de Industria y Comercio
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Be able to demonstrate to the Superintendencia de Industria y Comercio, at its request, that you have implemented appropriate and effective measures to comply with Ley 1581 de 2012 and its regulating chapter, in proportion to your legal nature and size, the nature of the data, the type of processing and the risks to data subjects.
- Answer the Superintendencia's request with a description of the procedures you use to collect, store, use, circulate and delete personal data, the purposes of the collection and an explanation of why each kind of data is needed, and with evidence that you have effectively implemented appropriate security measures.
- Keep internal policies that guarantee an administrative structure proportionate to your size, internal mechanisms including tools, training and education programs, and processes for answering data subjects' queries, requests and claims.
These lines are LexLint's reading of the law's text.
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 2.2.2.25.6.1 requires a controller to be able to show the Superintendencia, on request, the measures it has implemented and the procedures it uses for personal data. A controller can make that showing only from records of those measures and procedures. The text names no log, contents or keeping period.
- Kind
- Implicit
- As of
- Provision
- Decreto 1074 de 2015, art. 2.2.2.25.6.1
- Trigger
- personal_data_processing
What this law does
Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on . A controller must be able to demonstrate, on the Superintendencia's request, that it has implemented appropriate and effective measures to comply with Ley 1581 de 2012 and the chapter, in proportion to its legal nature and size, the nature of the data, the type of processing and the risks to data subjects.
Effective internal policies must guarantee an administrative structure proportionate to the controller's size, internal mechanisms including training and education programs, and processes for answering data subjects' queries and claims. The Superintendencia's finding that a controller has specific measures and policies for handling personal data properly is weighed when it decides whether to impose sanctions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .