ColombiaLey 1266 de 2008, Habeas Data Rights and Procedures for Credit and Financial Data Banks
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Answer a data subject's request to consult the personal data held in your data bank within ten business days of receipt; if you cannot, tell the data subject the reasons and the date, which may not be more than five business days after the first term ends.
- Answer a data subject's claim to correct or update data within fifteen business days from the day after receipt; if you cannot, tell the data subject the reasons and the date, which may not be more than eight business days after the first term ends.
- As a data bank operator, add to the individual record, within two business days of receiving a complete claim, a legend reading reclamo en trámite with the nature of the claim, keep it until the claim is decided and include it in the information you give to users.
- Where an independent source of the information exists, pass the claim to the source within two business days; the source must resolve it and answer the operator within ten business days, and the operator must answer the data subject within fifteen business days, extendable by eight.
- Check fully the data subject's observations and all the pertinent information before answering a claim.
- Treat a petition or claim left unresolved within the deadline as accepted, and let the data subject ask the Superintendencia de Industria y Comercio or the Superintendencia Financiera de Colombia to impose sanctions.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 16 requires a legend on the individual record while a claim is open or a judicial discussion is pending. That legend marks the data and is not a log of processing, and the article sets no keeping period or body that may demand a log, so the row records no logging duty. The articles cited here carry no territorial scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Ley 1266 de 2008 entered into force on . Ley 1266 de 2008 applies to all personal data registered in a data bank, whether run by a public or a private entity. A request to consult personal data in a data bank must be answered within ten business days of receipt, extendable once by no more than five business days when the data subject is told the reasons and the date.
A claim to correct or update data must be answered within fifteen business days from the day after receipt, extendable once by no more than eight business days when the data subject is told the reasons and the date. Within two business days of receiving a complete claim, the operator must add to the individual record a legend that reads reclamo en trámite and states the nature of the claim. A petition or claim not resolved within the deadline is deemed accepted for all legal purposes.
Numeral 8 on silence was added by article 7 of Ley 2157 de 2021. A holder of financial and credit information may also complain to the supervisory authority against sources, operators or users, and ask it to order an operator or source to correct or update their personal data.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .