International data transfers under Colombia's Law 1581 of 2012 are allowed whenever (i) the data is transferred to third parties operating under adequate regulatory protection; (ii) the transfer is performed under consent of the data holder or any other legal exception allowing data transfer.

A Declaration of Conformity is the authorization granted by the Superintendency of Industry and Commerce (DPA) to a data controller. It allows a specific data transfer with a prior assessment of the level of protection of the recipient country.

When considering a Declaration of Conformity for an international data transfer, the DPA will request the following aspects about the recipient country. These must be addressed when requesting a Declaration of Conformity.

• Data protection regulations

• Principles, rights and duties of data holders, controllers and processors

• Mechanisms to enforce rights

• Documents specifying that the relevant regulator is monitoring enforcement

• Identification of the controllers involved in the data transfer

• Description of the process to execute the data transfer

• Purpose of the data transfer

• Description of the data to be transferred

• Proof that the recipient country meets an adequate level of protection

For more information or assistance regarding this issue, please do not hesitate to contact us.