Habeas Data is a constitutional right in Colombia, but it is Law 1581 that develops and regulates this right, and it is in this law where all the rights, duties, and procedures that companies must follow are established.
Article 15 of the Political Constitution of Colombia states: “All persons have the right to their personal and family privacy and to their good name, and the State must respect them and ensure that they are respected. Likewise, they have the right to know, update, and rectify the information that has been collected about them in databases and files of public and private entities. In the collection, processing, and circulation of data, freedom and other guarantees enshrined in the Constitution shall be respected…”
In today’s digital era, data protection is not only a legal obligation but also a fundamental pillar for your customers’ trust and your company’s reputation. Compliance with Law 1581 of 2012 in Colombia is an unavoidable requirement for any organization that handles personal data. Ignoring it may lead to penalties of up to 2,000 legal monthly minimum wages (SMMLV) and irreparable damage to your corporate image.
You are responsible when you decide on the collection and use of the data.
- Obtain prior, express, and informed authorization from the data subject.
- Inform the data subject.
- Guarantee the rights of the data subject.
- Keep evidence of the authorization granted by the data subject.
- Adopt administrative, technical, and legal security measures to protect the data against loss, unauthorized access, or fraud.
- Register the databases in the RNBD (National Registry of Databases) of the SIC.
- Report security incidents affecting personal data to the SIC.
- Update the information reported to the RNBD and keep it current.
- Comply with the principles of the law.
Our consultants, with certifications in Information Security and specialized training in Personal Data Protection (CISM, CISA, ISO 27001 L.A., CISSP, CDPP, etc.), will apply best practices in the processing of personal data in your organization. They will guide you through the process, carrying out professional consulting for regulatory compliance from legal, technical, and organizational perspectives, collaborating in the implementation of IT tools (ISO 27001 controls) to protect data in terms of integrity, confidentiality, and availability.
Our consultants will independently evaluate the guiding principles for the processing of personal data to determine the organization’s level of compliance with Law 1581 in a comprehensive way, both internally and in its relationship with each and every third party with whom it establishes links in the roles that correspond to them (data subjects and data processors of the personal data bank, and third parties providing services).
Kick-off meeting and identification of the project team.
Interviews, questionnaires, and a detailed analysis of documentation, inventories, associated processes, systems, procedures, and review of compliance with applicable regulations will be carried out.
Report on the technical and legal considerations necessary to avoid the activities and circumstances that cause the company’s non-compliance with the regulations on the protection of personal data.
Registration of the personal databases of the operators and administrators of these databases before the National Data Protection Authority.
Working session with the project coordinator in order to review the draft legal and technical report.
An audit will be carried out in accordance with international requirements to verify proper compliance with the security requirements contemplated in the national regulations, based on the information contained in the databases.
Delivery of the Audit Report and the option of training for the designated staff.
As a result, an Adaptation Report and an Action Plan of measures to be implemented will be obtained.
