On September 11, 2023, the Superintendence of Industry and Commerce ("SIC"), as the competent authority to issue instructions regarding the protection and processing of personal data in Colombia, issued External Circular No. 01 of 2023, which regulates the processing of Personal Data for advertising, marketing or political and electoral prospecting purposes, specifically within the framework of the 2023 territorial elections, which will be decided next October 29.

Specifically, the following instructions have been issued:

1. Prior to the processing of the information, the manner in which it shall be proven that useful measures have been adopted to comply with the rules on the due Data Processing shall be established.
2. When third parties are used to carry out marketing, marketing and advertising campaigns, the Controller shall verify respect and compliance with its "Information Processing Policy". 
3. A proactive measure within the framework of the 2023 territorial elections, is the performance of privacy impact studies for those activities that involve the Processing of Personal Data.
4. From before the information is collected and throughout its life cycle, it is advisable to adopt preventive security measures of different nature (technological, organizational, human and procedural, among others) to avoid adulteration, loss, consultation, use or unauthorized or fraudulent access.
5. It should be continuously verified whether the personal data were obtained lawfully and that they can be used for advertising, marketing or political and electoral prospecting purposes.
6. In order to avoid complaints before the control authority and possible administrative investigations, the importance of suppressing all personal data bases that do not have the prior, express and informed authorization of the data subjects for their information to be used for advertising, marketing or political and electoral prospecting purposes shall be taken into account.
7. Only data that is essential to fulfill the purpose for which it must be collected may be collected.
8. It is necessary to suspend the use of contact data -e-mail address, telephone number- for advertising purposes, when so required or requested by the data subject.
9. It is important to train the work team in charge of advertising political campaigns so that electoral marketing activities are carried out in compliance with the provisions of Statutory Law 1581 of 2012; especially that the principles, rights, guarantees and procedures set forth in said statutory regulation are respected.
10. Data Controllers and Processors shall implement monitoring mechanisms - internal or external audits - aimed at ensuring compliance with the aforementioned measures.