Law 1581 of 2012 regulated the general data protection regime in Colombia, which is administered by the Superintendence of Industry and Commerce. This regime applies to databases containing personal data, whether processed manually or automatically, and whether managed by public or private entities operating within the national territory.
This regulation aims to develop the constitutional rights to privacy and information through a system that allows individuals to know, update, and rectify the information about them held in databases or files.
Article 25 of the aforementioned law provided for the creation of the National Database Registry (Registro Nacional de Bases de Datos, RNBD), which is the public directory of databases subject to processing in the country. The registry will allow for knowledge of how personal data is handled, as it will enable consultation of the number of existing databases, the parties responsible, information processing policies, and the channels available for data subjects to file complaints, claims, or requests.
It is important to emphasize that this regime applies to all companies that store, use, or circulate data, i.e., that process personal data, regardless of the company's size, capital, or number of employees, as the law does not provide any exceptions in this regard. Business owners must be clear that systems where information on clients, suppliers, or employees (or potential ones) is collected also constitute databases and must therefore be registered with the RNBD.
Please note that when registering your database, the minimum information you must have is as follows:
- The identification, location, and contact details of the party responsible for processing the database.
- The identification, location, and contact details of the party in charge of processing the database.
- Available channels for data subjects to exercise their rights.
- Name and purpose of the database.
- Method and processing of the database (manual, if the information is organized and stored physically; or automated, if stored or managed using computer tools).
- Information processing policy.
Similarly, it is pertinent to note that the deadline for database registration is not unlimited, in accordance with Article 12 of Decree 886 of 2014, which states that once the RNBD is enabled, a one-year term is granted for registration, which began running on November 9, 2015.
It is expected that during the current year, registration will be enabled for natural persons. However, if databases are created after that term, there will be 2 months to complete the registration.
Given the above conditions, it is important to know that anyone who fails to comply with their duty to register with the RNBD within the established deadline will be subject to a sanction, which may be:
-
Fines of a personal and institutional nature up to the equivalent of two thousand (2,000) times the current legal monthly minimum wage at the time the sanction is imposed. Fines may be successive while the breach that caused them persists.
- Suspension of activities related to processing for up to six (6) months. The suspension order will indicate the corrective measures to be adopted.
- Temporary closure of operations related to processing once the suspension period has elapsed without the corrective measures ordered by the Superintendence of Industry and Commerce having been adopted.
- Immediate and definitive closure of operations involving the processing of sensitive data.
Contact us to assist you with the registration of your databases:
[button title="CONTACT" link="http://cutandframe.com/azc/contacto" description="" width="180px" bgcolor="#003366" color="#ffffff" picture="" height="" version="light" position="left"]
.