ColombiaLey 1266 de 2008, Supervision and Sanctions for Credit and Financial Data Banks
Ley Estatutaria 1266 de 2008, arts. 17 y 18 (Funcion de Vigilancia y Sanciones)
In force since .
An enforcement supervision rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Independent third party
- Where the report goes
- Produced on request
What it requires
- Comply with the instructions and orders of the Superintendencia de Industria y Comercio, or of the Superintendencia Financiera de Colombia where you are an entity it supervises, on how to administer financial, credit, commercial, service and third-country information.
- Carry out the external systems audit the supervisory authority orders at your cost to verify compliance.
- Comply with the authority's order to correct, update or withdraw personal data, which it may give on its own initiative or on a data subject's request after the claim to the operator or source went unanswered or was answered unfavorably.
- Accept administrative fines of up to 2,000 current monthly legal minimum wages, which may be imposed successively while the violation continues, suspension of the data bank's activities for up to six months for a serious violation, and closure of the operation; a data bank that administers prohibited data is closed immediately and permanently.
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Superintendencia de Industria y Comercio and, for entities it supervises, Superintendencia Financiera de Colombia
What it makes you log
Logging duty
Articles 17 and 18 name the supervisory authorities, list their powers, including ordering external systems audits, and set the sanctions. They name no log or keeping period, so the row records no logging duty and treats the audit order as an on-request check by the regulator. The articles cited here carry no territorial scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
The Superintendencia de Industria y Comercio supervises the operators, sources and users of financial, credit, commercial, service and third-country information as to the administration of personal data. Where the source, user or operator of information is an entity supervised by the Superintendencia Financiera de Colombia, that authority supervises it and imposes the sanctions.
The supervisory authority may order, at the cost of the operator, source or user, external systems audits to verify compliance with the law. Fines may reach the equivalent of 2,000 current monthly legal minimum wages at the time of the sanction. Article 14 of Ley 2157 de 2021 modified the fines paragraph of article 18. A data bank's activities may be suspended for up to six months where information is administered in serious violation of the law's conditions and requirements. The operation of data banks that administer prohibited data is closed immediately and permanently.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .