ColombiaLey 1266 de 2008, Duties and Special Requirements of Credit Information Data Bank Operators
In force since .
A data brokers rule binding public and private bodies.
- Obligation class
- Governance, Security, Access restriction
- Audit expectation
- none
What it requires
- Adopt an internal manual of policies and procedures to ensure compliance with the law, above all for handling data subjects' queries and claims.
- Keep the stored records securely to prevent their deterioration, loss, alteration or unauthorized or fraudulent use.
- Let only the persons the law allows access the information, and circulate it to users only within the limits of the law.
- Where the law makes the data subject's authorization necessary, ask the source for a certification that the authorization exists.
- Update and correct the data each time the sources report changes.
- Do not make personal data in the data bank, other than public information, accessible on the internet or by other mass media unless access is technically controllable so that only data subjects or authorized users can see it.
- If you operate independently of the sources, be set up as a commercial company, a non-profit entity or a cooperative; keep a service area for data subjects' petitions, queries and claims; keep a security system and technical conditions that prevent adulteration, loss, and unauthorized consultation or use of the records; and update the information the sources report at intervals of no more than ten calendar days from receiving it.
- Comply with the instructions and requirements the supervisory authority gives on compliance with the law.
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Articles 7 and 11 require operators to keep records securely and to update them, and set no log, keeping period or body that may demand a log, so the row records no logging duty. The articles cited here carry no territorial scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Ley 1266 de 2008 entered into force on . An information operator is a person, entity or organization that receives personal data on several data subjects from sources, administers it and makes it known to users under the law. Unless the operator is itself the source, the operator has no commercial or service relationship with the data subject.
An operator of a data bank must adopt an internal manual of policies and procedures to ensure compliance with the law and to handle data subjects' queries and claims. An operator of a data bank must keep the stored records securely to prevent their deterioration, loss, alteration or unauthorized or fraudulent use.
Personal data in a data bank, other than public information, may not be accessible on the internet or by other mass media unless access is technically controllable so that only data subjects or authorized users can see it. An operator that works independently of the sources must be set up as a commercial company, a non-profit entity or a cooperative.
An operator that works independently of the sources must update the information the sources report at intervals of no more than ten calendar days from receiving it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .