ColombiaLey 1581 de 2012, Cross Border Data Transfer
Ley 1581 de 2012, arts. 26-27 (Transferencia a Terceros Paises)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not transfer personal data to a country the Superintendencia de Industria y Comercio has not found to offer an adequate level of data protection, absent a recognized exception.
- Rely on the cross border transfer exceptions only where the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical exchange required for treatment or public health, a banking or securities transfer under its own law, a transfer under a reciprocal international treaty Colombia has joined, a transfer necessary to perform a contract with the data subject, or a transfer legally required to safeguard the public interest or defend a right in a judicial proceeding.
- Where none of the listed exceptions applies, obtain the Superintendencia de Industria y Comercio's declaration of conformity before transferring personal data internationally.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 26 and 27 prohibit transfers of personal data to countries without an adequate level of protection, list the exceptions and, for cases outside them, leave the declaration of conformity to the Superintendencia de Industria y Comercio, whom paragraph 1 of article 26 empowers to require information from the controller. That is a power to demand information with no record named, so the row records no logging duty and treats the power as an on-request check by the regulator. Article 27 only promises regulations on binding corporate rules. The articles cited here contain no scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Article 26 prohibits transferring personal data of any kind to a country that does not provide an adequate level of data protection, measured by standards the Superintendencia de Industria y Comercio sets and that may never fall below this law's own requirements, unless the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical data exchange required for the data subject's health treatment or public hygiene, the transfer is a banking or securities transfer under its own applicable law, the transfer is agreed under an international treaty Colombia has joined on a reciprocity basis, the transfer is necessary to perform a contract with the data subject or precontractual measures the data subject has authorized, or the transfer is legally required to safeguard the public interest or to establish, exercise or defend a right in a judicial proceeding, and requires the Superintendencia's declaration of conformity before any transfer outside those exceptions.
Article 27 requires the National Government to regulate Binding Corporate Rules certifying good personal data protection practices for a transfer to a third country.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .