Your company probably has a customer database, another for employees and another for suppliers. Maybe also the records of everyone who fills out the contact form on your website. All of that data has something in common: in Colombia, how it's handled is regulated by Law 1581 of 2012, the personal data protection law.
Many companies only know it from the "I authorize the processing of my data" checkbox on forms. But complying with it goes well beyond a checkbox.
What is personal data?
It's any information that can identify a person: name, ID number, email, phone, address or photograph. The law also defines sensitive data, which requires special care, such as health information, biometric data (fingerprints or facial recognition), political or religious views and data about minors.
The main obligations
- Ask for authorization: you must obtain the person's consent before collecting their data and tell them what you'll use it for
- Have a data processing policy: a public document explaining what data you collect, why, how you protect it and how people can exercise their rights
- Respect the purpose: if the data was collected for billing, it can't be used for marketing campaigns without new authorization
- Handle requests and complaints: people have the right to access, update, correct and request deletion of their data
- Protect the information: the law requires technical, human and administrative security measures that prevent loss, unauthorized access or misuse
The National Database Registry
Companies and non-profits with total assets above 100,000 UVT, as well as public entities, must register their databases in the National Database Registry (RNBD) of the Superintendence of Industry and Commerce (SIC) and keep it up to date.
In addition, when a security incident compromises personal data, such as data theft or a ransomware attack, it must be reported to the Superintendence.
What happens if you don't comply?
The Superintendence of Industry and Commerce can impose fines of up to 2,000 monthly minimum wages and suspend data processing activities. Beyond the penalty, a customer data leak is a direct blow to trust in the brand.
How technology supports compliance
The legal side defines the rules, but much of compliance happens in your systems:
Know what data you have and where it is
The first step is an inventory: which databases exist, what information they hold, who uses them and where they're stored. It's common to find copies in spreadsheets, emails or personal computers that nobody had accounted for.
Control who has access
Not everyone in the company needs to see all the data. Role-based permissions, multi-factor authentication and logs of who views what information reduce the risk of leaks.
Encrypt and back up
Data should be encrypted in databases, in backups and while moving between systems. And backups must be tested regularly.
Keep only what you need
Every piece of data you store is data you must protect. Defining retention periods and deleting what's no longer needed reduces both risk and cost.
Record authorizations
Your systems should store when and how each person gave their authorization, so you can prove it if the Superintendence asks.
Where to start
If you've never reviewed this topic, start with the database inventory and make sure your data processing policy is published and up to date. Then prioritize securing the databases that hold sensitive data.
At Datandina we help with the technical side of compliance: data inventory and classification, access control, encryption, backups and recording authorizations in your systems. For the legal side, we recommend working with a lawyer who specializes in data protection.