ColombiaDecreto 1074 de 2015, Binding Corporate Rules for International Transfers
Decreto 1074 de 2015, arts. 2.2.2.25.7.1 a 2.2.2.25.7.8 (Normas Corporativas Vinculantes)
In force since .
A cross border transfer rule binding private bodies.
- Obligation class
- Transfer, Governance
- Audit expectation
- none
What it requires
- If you are a business group that transfers personal data from Colombia to a controller of the group outside Colombia, comply with the Binding Corporate Rules that bind every member of the group, unless the group applies another transfer mechanism that Colombian law establishes.
- Make the Binding Corporate Rules ensure that the group processes data lawfully, fairly and transparently, for specified, explicit and legitimate purposes, limited to what is necessary, accurately and kept up to date, and kept in identifiable form no longer than necessary, and that the rules secure the principles of article 4 of Ley 1581 de 2012, the special categories of data, the data subject's rights and the controller's duties.
- Submit the Binding Corporate Rules to the Superintendencia de Industria y Comercio only after the competent corporate body has approved them; they apply only from the date the Superintendencia issues its certification.
- Once the Binding Corporate Rules are approved, say so on the group's website.
- Accept that every group company and member is jointly liable for compliance with the Binding Corporate Rules.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 7 requires binding corporate rules to include audit mechanisms and a way to record and notify changes to the Superintendencia, but names no log, contents, keeping period or body that may demand a log, so the row records no logging duty. Article 2.2.2.25.7.2 reaches a group that transfers personal data out of Colombia, so no separate territorial hook is recorded.
- Kind
- None
- As of
What this law does
Section 7 of Chapter 25 was added by Decreto 255 de 2022, which governs from its publication. Decreto 255 de 2022 was published in the Diario Oficial of . Binding Corporate Rules are mandatory for a business group that transfers personal data to a controller of the group outside Colombia, unless the group applies another transfer mechanism that Colombian law establishes.
Binding Corporate Rules submitted to the Superintendencia take effect only from the date it issues its certification. The group's members are jointly liable for compliance, and the Superintendencia may require, investigate and sanction the controller established in Colombia for infractions by any member of the group.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .