The Ministry of Commerce, Industry, and Tourism, through Decree No. 1115 of June 29, 2017, extended the deadline for registration and the National Database Registry (NDBR) before the Superintendence of Industry and Commerce.
In response to the multiple requests received by the Superintendence of Industry and Commerce, the entity responsible for administering the National Database Registry (NDBR), the deadline established by Law 1581 of 2012 “by which general provisions for the protection of personal data are issued”, was modified in order to increase the dissemination and socialization of this legal obligation and to ensure a high degree of compliance with the regulation.
This regulation establishes that Data Controllers, private legal entities and mixed economy companies registered with the country's chambers of commerce, must carry out the aforementioned registration no later than January thirty-first (31), 2018, in accordance with the instructions issued for that purpose by the Superintendence of Industry and Commerce.
Likewise, Decree 1115 proceeds to set the date on which natural persons, public entities, and private legal entities not registered with a chamber of commerce must comply with the obligation to register their databases and comply with a data processing policy in accordance with Law 1581 of 2012 and its regulatory decrees, the deadline for which was set for January thirty-first (31), 2019.
Consequently, as of today, the Superintendence of Industry and Commerce has enabled registration channels for all natural persons, public entities, and private legal entities not registered with a chamber of commerce, to carry out their registrations and be in compliance with current legislation regarding the protection of personal data.
Likewise, the Superintendence clarifies that this procedure has no exception that excludes its application based on the size of the company, the number of employees it has, or the amount or type of personal data it manages.