ColombiaLey 1581 de 2012, Data Subject Rights and Procedures
Ley 1581 de 2012, arts. 8, 12, 14-16 (Derechos de los Titulares)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a data subject the right to know, update and rectify their personal data, request proof of the authorization given, be told on request how their data has been used, revoke the authorization or seek deletion where the processing violates their constitutional or statutory rights, and access their personal data free of charge.NIST Privacy FrameworkCT.PO-P3
- Before requesting a data subject's authorization, tell them clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, their rights as a data subject, and how to identify and contact you, and keep proof that you gave this notice.NIST Privacy FrameworkCM.AW-P1
- Answer a data subject's request to consult their personal data within ten business days, or tell them the reason for delay and a new date no more than five business days later.NIST Privacy FrameworkCT.DM-P1
- Mark the record with a pending claim legend within two business days of receiving a complete claim for correction, updating or deletion, and resolve the claim within fifteen business days, or fifteen days extendable by eight more days with notice of the delay and a new resolution date.NIST Privacy FrameworkCT.PO-P3
- Expect a data subject to complain to the Superintendencia de Industria y Comercio only after they have exhausted the consultation or claim procedure with you.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
What the log must hold
Consent or opt-out state, Disclosure shown
Logging duty
The paragraph to article 12 requires the controller to keep proof that it gave the data subject the notice of purposes, rights and controller identity that article 12 lists, and to hand the data subject a copy on request. Article 8(b) lets the data subject ask for proof of the authorization given, and article 14 lets a consultation be made only by a channel through which proof of it can be kept. Article 15 has the controller mark a record with a 'reclamo en tramite' legend while a claim is open, a flag on the data and not a log. No period is set for keeping any of this. The data subject's access to the proof is access to their own record and not an audit of it, so no audit is recorded. The articles cited here contain no scope clause, so no territorial hook is recorded.
- Kind
- Explicit
- As of
- Provision
- Article 12, paragraph (with articles 8(b) and 14)
- Trigger
- consent_or_optout
What this law does
Article 8 gives every data subject the right to know, update and rectify their personal data before the controller or processor, request proof of the authorization given, be told on request how their data has been used, file a complaint with the Superintendencia de Industria y Comercio, revoke the authorization or seek deletion of the data where the processing does not respect their constitutional or statutory rights, and access their personal data free of charge.
Article 12 requires the controller, at the moment of requesting authorization, to tell the data subject clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, the rights the data subject holds, and the controller's identification and contact details, and to keep proof that this notice was given.
Article 14 gives the data subject or their successors the right to consult their personal data held in any public or private database, to be answered within ten business days, extendable by five more business days with notice of the delay and a new date.
Article 15 gives the right to lodge a claim for correction, updating or deletion, or over a suspected breach of any duty this law imposes, requires a pending claim legend to be added to the record within two business days of a complete claim, and sets fifteen business days to resolve it, extendable by eight more with notice of the delay and a new date.
Article 16 conditions a complaint to the Superintendencia de Industria y Comercio on having first exhausted the consultation or claim procedure before the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .