We remind you that, in accordance with the Sole Circular of the Superintendence of Industry and Commerce, all companies and non-profit entities that have total assets exceeding 100.000 Tax Value Units (UVT), which is equivalent to approximately COP$ 4,979,900,000 by 2025 (approx. USD$ 1,180,919.00), and all Legal Entities of a public nature, which process personal data as Data Controllers under the scope of application of Law 1581 of 2012, are required to register their databases before the National Database Registry ("RNBD").

Furthermore, the Superintendence of Industry and Commerce established the following obligations related to the need to update the RNBD:

• The information of the area or person in charge of handling matters related to personal data (e.g., the Data Protection Officer) must be reported to the SIC;
• Within the first fifteen (15) working days of the months of February and August of each year, the information on the claims submitted by the Holders must be reported and/or updated. In this sense, for this first semester, the report of complaints and/or claims must be made no later than February 21, 2025;
• Between January 2 and March 31, 2025, the update of the registry on non-substantial changes must be made;
• Substantial changes shall be reported within the first ten (10) business days of the month following when they were implemented; and
• New databases shall be registered within two (2) months of their creation.

In view of the above, we recommend those who are obliged to comply with these obligations to carry out the corresponding procedures as soon as possible in order to avoid investigations and penalties for non-compliance with the regulations applicable to the right of habeas data.

The Dentons Cárdenas & Cárdenas team is at your complete disposal to answer any questions related to these procedures.