ColombiaSIC Circular Externa 3 de 2018, Security Incident Reporting
In force since .
A breach notification rule binding public and private bodies.
- Instrument type
- a binding direction issued under an act
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- If you are a controller that must register your databases in the national database registry (RNBD), report each security incident that affects a database you administer or your processor administers to that registry within 15 business days after you detect it and the person or area responsible for handling it learns of it.
- If you are a controller that need not register your databases, or a processor, report each security incident that affects the information in your databases to the Superintendencia de Industria y Comercio through its online application or another channel it enables, within the same 15 business days.
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Numeral 2.1(f)(ii) requires a security incident to be reported to the registry or to the Superintendencia within 15 business days. It does not tell the controller or the processor to document, register or keep a record of the incident, so the row records no logging duty. The numeral carries no scope clause on territory, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Numeral 2.1(f)(ii) of Chapter 2, Title V of the Superintendencia's Circular Única requires a security incident to be reported within 15 business days after it is detected and reaches the person or area responsible for handling it. A security incident is a violation of the security codes, or the loss, theft or unauthorized access of information in a database administered by the controller or its processor.
A controller that must register its databases in the national database registry reports the incident to that registry. A controller that need not register, and any processor, reports the incident to the Superintendencia through its online application or another channel it provides.
Circular Externa 3 de 2018 was published in the Diario Oficial on . Circular Externa 3 de 2018 takes effect on the date of its publication in the Diario Oficial. Numeral 2.1 of Chapter 2, Title V of the Circular Única reads as Circular Externa 3 de 2018 wrote it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .