Data Protection: Minimum Measures for Businesses in Colombia

Why Data Protection is Mandatory for Your Business

In Colombia, personal data protection is not optional. Law 1581 of 2012 and its regulatory decrees establish specific obligations for any natural or legal person that collects, stores, or uses personal data from customers, employees, or suppliers.

Non-compliance with these regulations can result in fines of up to 2,000 current legal minimum wages, temporary business closure, and significant reputational damage.

If you need specialized advice on data protection and legal compliance, learn about our cybersecurity and digital law services in Santa Marta.

Legal Framework for Data Protection in Colombia

Main Regulations

• Law 1581 of 2012: Statutory law on personal data protection
• Decree 1377 of 2013: Partially regulates Law 1581
• Decree 1074 of 2015: Single Regulatory Decree for the commerce sector (Title 26)
• External Circular 002 of 2015: SIC instructions on the National Database Registry

Supervisory Authority

The Superintendence of Industry and Commerce (SIC) is the authority responsible for monitoring compliance with data protection regulations and imposing sanctions for violations.

Fundamental Concepts You Should Know

Before implementing protection measures, it is important to understand the basic concepts:

Types of Personal Data

Roles in Data Processing

• Data Subject: Natural person whose data is being processed
• Controller: Who decides on data processing
• Processor: Who performs processing on behalf of the controller

The 10 Minimum Data Protection Measures

Measure 1: Data Processing Policy

Every business must have a data processing policy that includes:

• Name or business name of the controller
• Address and contact information
• Processing activities the data will undergo
• Rights of data subjects
• Mechanisms for inquiries and complaints
• Purpose of processing

This policy must be available for consultation by data subjects and published on your website if you have one.

Measure 2: Prior and Express Authorization

Before collecting any personal data, you must obtain authorization from the data subject that is:

• Prior: Before collection
• Express: Clear and unequivocal manifestation
• Informed: The data subject must know the purpose

Measure 3: Privacy Notice

The privacy notice is different from the processing policy. It is a short document that must communicate to the data subject:

• Name of the controller
• Purpose of processing
• Rights of the data subject
• How to exercise their rights
• Where to consult the complete policy

It must be provided at the time personal data is requested.

Measure 4: National Database Registry

If your business is a legal entity or has more than 100,000 UVT in assets or more than 100 employees, you must register your databases with the SIC.

The registry includes:

• Identification of each database
• Purpose of processing
• Implemented security measures
• Customer service channels for data subjects

Measure 5: Technical Security Measures

Implement technological controls to protect data:

Access Security:

• Strong passwords and periodic changes
• Two-factor authentication when possible
• Role-based access control
• Database access logging

Storage Security:

• Encryption of sensitive databases
• Periodic backups
• Secure storage of physical copies
• Secure destruction of obsolete data

Transmission Security:

• Encrypted connections (HTTPS, VPN)
• Secure emails for sensitive data
• Control of USB devices and removable media

Measure 6: Administrative Security Measures

Establish clear internal procedures:

Documentation:

• Information security policy manual
• Incident handling procedures
• Confidentiality agreements with employees
• Contracts with data processors

Training:

• Employee training on data protection
• Periodic updates on best practices
• Privacy culture in the organization

Measure 7: Handling Inquiries and Complaints

You must establish effective channels for data subjects to exercise their rights:

Recommended Channels:

• Email dedicated to data protection
• Website form
• In-person service with documented procedure

Response Deadlines:

• Inquiries: 10 business days (extendable by 5 more days)
• Complaints: 15 business days (extendable by 8 more days)

Measure 8: Contracts with Processors

If third parties process data on behalf of your company, you must:

• Enter into written data processing agreements
• Establish security and confidentiality obligations
• Define authorized purposes
• Include audit clauses
• Establish responsibilities in case of incidents

Measure 9: Transfers and Transmissions

If you transfer data to third parties or to other countries, you must comply with additional requirements:

Transfer (change of controller):

• Requires authorization from the data subject
• Must inform the new controller about the original conditions

Transmission to other countries:

• Only to countries with adequate level of protection (SIC list)
• Or through standard contractual clauses
• Or with express authorization from the data subject

Measure 10: Incident Response Plan

Prepare your organization to react to security breaches. If a breach occurs, check our detailed guide on what to do after a data breach.

Plan Elements:

• Definition of data security incident
• Team responsible for incident management
• Immediate containment procedure
• Protocol for notifying SIC and data subjects
• Documentation and lessons learned process

Notification Deadlines:

• To the SIC: within 15 business days following the incident
• To data subjects: when the incident significantly affects their rights

Minimum Compliance Checklist

Use this list to verify your compliance level:

Mandatory Documentation

• Published data processing policy
• Authorization forms for data collection
• Privacy notices for each collection point
• Information security manual
• Contracts with data processors
• Database registry (if applicable)

Implemented Processes

• Procedure for handling inquiries and complaints
• Incident response procedure
• Employee training program
• Secure data destruction process
• Periodic compliance audit

Technical Measures

• Access controls to systems with personal data
• Automated backups
• Encryption of sensitive data
• Access and modification logging
• Updated antivirus and firewall

Penalties for Non-Compliance

The SIC can impose the following sanctions:

Graduation Criteria

The SIC considers:

• Dimension of damage or danger
• Economic benefit obtained
• Recidivism
• Resistance to investigation
• Procedural conduct of the investigated party
• Express acknowledgment of the infraction

Special Processing Cases

Data of Minors

Processing of minors' data has special rules:

• Only public data can be processed
• Requires authorization from the legal representative
• Must respond to their best interests
• Sensitive data processing prohibited (with exceptions)

Biometric Data and Video Surveillance

If you use security cameras or biometric systems:

• Inform through visible notices
• Define retention periods
• Limit access to recordings
• Establish deletion protocol

Health Data

Health data is sensitive and requires:

• Specific express authorization
• Processing only by authorized personnel
• Enhanced security measures
• Special care in transmissions

First Steps to Start Compliance

If your business has not yet implemented data protection measures, follow these steps:

Phase 1: Diagnosis (Week 1-2)

1. Identify all company databases
2. Determine what personal data you collect
3. Map data flows (where they come from, where they are stored, who accesses them)
4. Identify third parties that process data on your behalf
5. Evaluate current security measures

Phase 2: Documentation (Week 3-4)

1. Draft the data processing policy
2. Prepare authorization forms
3. Design privacy notices
4. Prepare contracts with processors
5. Document security procedures

Phase 3: Implementation (Week 5-8)

1. Publish the policy through appropriate channels
2. Implement authorization forms
3. Update contracts with third parties
4. Configure technical security measures
5. Train staff

Phase 4: Maintenance (Ongoing)

1. Monitor compliance periodically
2. Update documentation when processes change
3. Conduct refresher training
4. Handle inquiries and complaints promptly
5. Document incidents and lessons learned

Additional Resources

Where to Get More Information

• SIC: www.sic.gov.co - Compliance guides and tools
• National Database Registry: rnbd.sic.gov.co
• Regulations: www.funcionpublica.gov.co - Law 1581 and decrees

Useful Tools

• Privacy policy templates
• Contractual clause models
• Sector-specific implementation guides
• Free virtual training sessions

Benefits of Compliance

Beyond avoiding sanctions, complying with data protection adds value to your business:

1. Trust: Customers prefer companies that protect their information
2. Competitiveness: Requirement for contracting with large companies and the government
3. Security: Reduces risks of cyberattacks and leaks
4. Organization: Improves business information management
5. Internationalization: Facilitates operations with countries with strict regulations
6. Reputation: Avoids crises from improper data handling