ColombiaLey 1581 de 2012, Security Breach Notification to the Authority
Ley 1581 de 2012, arts. 17(n), 18(k) (Notificacion de Violaciones de Seguridad)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the Superintendencia de Industria y Comercio when a violation of the security codes occurs and creates a risk in the administration of a data subject's personal information; the law fixes no deadline for this notice.
- As a data processor, notify the Superintendencia de Industria y Comercio under the same terms when a security code violation creates that risk; neither duty requires telling the affected data subject directly.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 17(n) and 18(k) require the controller and the processor to inform the data protection authority when security codes are violated and there are risks in the administration of data subjects' information. The duty is to notify. Neither clause tells either party to document, register or keep a record of the incident, and the statute sets no breach register, so the row records no logging duty. The articles cited here contain no scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Article 17(n) requires a data controller to inform the data protection authority when a violation of the security codes occurs and there is a risk in the administration of a data subject's information. Article 18(k) imposes the identical duty on a data processor, requiring it to inform the Superintendencia de Industria y Comercio under the same terms.
Neither literal fixes a deadline for the notice or requires telling the affected data subject directly, so the clock this law states runs only to the Superintendencia, triggered by a security code violation that creates that risk.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .