Colombia Update: Periodic obligations on personal data protection: annual update, and report on data subjects’ claims second semester 2021

Be reminded that as established by the General Circular of the Superintendency of Industry and Commerce, data controllers which are obliged to register their databases within the National Data Base Registry (NDBR) must perform at the beginning of each year, the annual update of the said registry. Such updates must be done between January 2nd and March 31st every year.

The mentioned updates must include any change that the database has suffered within the previous year, i.e. if the number of data subjects included in the database changed, if there was any change on the corporate name of the data controller, among others.

Please note that substantial changes, such as those related with the purposes to handle data, the data processor, the attention lines, classification and types of personal data, and international data transfers and transmissions, must be reported within the first 10 business days of the month in which the changes took place. 

If by the time of the annual update there are any substantial changes that have not been registered those should be registered at the annual update.

Also, it is necessary that within the first fifteen (15) business days of February, which means that no later than on February 21st, 2022, the data controllers perform the corresponding report of claims presented by data subjects in the previous semester (July to December 2021) must be reported. 

We look forward to any queries that you may have, or to supporting your team in compliance with the abovementioned obligations.

By LLOREDA CAMACHO & CO, Colombia, a Transatlantic Law International Affiliated Firm.  

For further information or for any assistance please contact colombia@transatlanticlaw.com 

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.