[co-author: José Daniel Suárez]

Colombia's Superintendence of Industry and Commerce (SIC) reiterated the importance of complying with its obligations as set forth through Circular 003 of Aug. 1, 2018, regarding the update and registrations of databases in the National Registry of Databases (NRD).

Corporations and nonprofit entities with total assets over 100,000 Tax Value Units (Unidades de Valor Tributario or UVT) (approximately $4,706,500,000 Colombian pesos by 2024) and legal entities of a public nature are responsible for complying with this obligation. They must report the general information on their databases containing personal data and its handling, in accordance with the provisions of the Personal Data Protection Law (Law 1581 of 2012).

All required organizations must perform the annual update of information reported in the NRD before March 31, 2024.

In addition to the general update, the aforementioned organizations must also comply with the following obligations:

• Update of reports: No later than within the first 15 working days of February (i.e., by Feb. 21, 2024), the report of claims filed by holders of personal data in the previous six-month period must be made. If no claims are filed, organizations must notify the SIC that there are no new developments.
• Monthly update: If substantial changes are made to the information reported in the NRD, these updates must be made within the first 10 working days of each month.
• New databases: When the data controller generates a new database, said database must be registered within a maximum of two months after its creation.

Failure to comply with these obligations has resulted in increased controls and surveillance by the SIC, generating administrative orders and high fines to those who do not act in accordance.