ColombiaSIC Circular Externa 3 de 2018, Additional National Database Registry Information
In force since .
A comprehensive regime rule binding public and private bodies.
- Instrument type
- a binding direction issued under an act
- Obligation class
- Licensing, Reporting
- Audit expectation
- none
What it requires
- If you are a company or non-profit entity with total assets above 100,000 UVT, or a public legal entity, register in the national database registry (RNBD), beside what Chapter 26 of Decreto 1074 de 2015 requires, the classification of the personal data stored in each database, grouped by categories and subcategories according to their nature.
- Register the information security controls you have implemented for each database, answering the questions the registry sets.
- Register whether the personal data in each database was collected from the data subject or supplied by third parties, and whether authorization or an exemption under article 10 of Ley 1581 de 2012 covers the processing.
- Register each international transfer of personal data with the recipient controller, its country, and whether a declaration of conformity or an exception under article 26 of Ley 1581 de 2012 covers it.
- Register each international transmission of personal data with the recipient processor, its country, and whether a transmission contract or a declaration of conformity covers it.
- Report, for each calendar half-year (January to June and July to December), the claims data subjects filed with you or your processor, by the claim types preset in the registry.
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Numeral 2.1 requires further information to be entered in the registry and a half-yearly report of data subject claims. It sets no log, no record of processing and no keeping period beyond the registry entry filed with the Superintendencia, so the row records no logging duty. The numeral carries no scope clause on territory, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Circular Externa 3 de 2018 requires companies and non-profit entities with total assets above 100,000 UVT, and public legal entities, to register further information about each database in the national database registry, beside what Chapter 26 of Decreto 1074 de 2015 requires. The further information includes the classification of the personal data stored in each database, grouped by categories and subcategories according to their nature.
The registry's security questions cover the controls the controller has implemented for the database, and they are not instructions about which security measures to implement. The registered information states whether the personal data was collected from the data subject or supplied by third parties, and whether authorization or an exemption under article 10 of Ley 1581 de 2012 covers the processing.
For each international transfer the controller registers the recipient controller, its country, and whether a declaration of conformity or an exception under article 26 of Ley 1581 de 2012 covers it. For each international transmission the controller registers the recipient processor, its country, and whether a transmission contract or a declaration of conformity covers it. The controller also reports, for each calendar half-year, the claims data subjects filed with it or its processor.
Circular Externa 3 de 2018 was published in the Diario Oficial on . Circular Externa 3 de 2018 takes effect on the date of its publication in the Diario Oficial. Numeral 2.1 of Chapter 2, Title V of the Circular Única reads as Circular Externa 3 de 2018 wrote it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .