On August 22 of this year, the Superintendence of Industry and Commerce (“SIC”) acting as Colombia’s Data Protection Authority (“DPA) issued another circular establishing data protection guidelines for the corporate administrators.

The main guidelines set forth in this Circular are the following:

• Corporate administrators will be considered by local authorities as jointly liable for the data processing when they determine, together with the legal entity, the purposes or means of the databases and/or the processing of data for specific operations.

  As of now, it is still unclear whether the SIC intends to extend liability to corporate administrators for inadequate personal data processing.

• Corporate administrators must comply with the data protection regulations.
• Corporate administrators must establish and monitor effective internal policies to ensure adequate data processing within the business operations.
• Companies will be required to have internal mechanisms to exercise effective internal policies, including tools for implementation, training, and awareness programs. These tools must be known and promoted by corporate administrators.
• Corporate administrators will be responsible for establishing guidelines for the adequate implementation of precautionary or preventive measures to protect data subject’s rights. For the appropriate implementation of these measures, it is highly advisable to implement privacy impact assessments. To achieve this the company may designate a person or area to assume the data protection responsibilities within the company.
• Corporate administrators have the responsibility to establish guidelines to continuously strengthen information security measures.

Please note that the implementation of these guidelines and corporate administrators’ possible liability will be determined by future SIC decisions and sanctions, as these requirements have yet to be enforced.

For more information about this new update and how it may affect your current service practices, please contact us. 

The circular is available here.