As part of enacting its General Regime of Personal Data Protection, Colombia created the National Database Registry (NDR) (Law 1581 of 2012). The NDR is a public directory of all databases in existence in the country,  with the primary objective of documenting unknown information, such as the number of databases, data owners, data processors, the treatment of data, etc. The NDR will be managed by the Superintendence of Industry and Commerce and as a public registry, will be open to consultation by Colombians and foreign citizens alike.

Why Does This Matter and Who Does It Affect?

The core of the issue is that all databases that include personal data, handled or processed by people or companies, both from the private and public sectors, within and without the Colombian territory, must register before de NDR, meaning anyone that has any type of database with personal data of Colombian nationals has to register in the NDR. In the case of databases that are not processed within Colombian borders, the registration depends on the applicable international treaties.

What are the deadlines?

Currently, the deadline to register in the NDR only applies to processors of databases from private companies subject to registration before the chambers of commerce in Colombia (Colombian corporations, local branches, agencies, etc) and companies with public and private funds.

The deadline to register the databases for the Colombian companies depend on their last digits of the Tax Identification Number (in Spanish –NIT-) as follows:

From 00 to 24 From 09 Nov 2015 to 08 Feb 2016
From 25 to 59 From 09 Feb 2016 to 10 May 2016
From 50 to 74 From 06 May 2016 to 08 Aug 2016
From 75 to 99 From 09 Aug 2016 to 08 Nov 2016

The information that has to be presented before the NDR must include at least the following:

Identification, location and contact information of the processor of data;

  • Identification, location and contact information of the data manager;
  • Ways or channels by which data owners may exercise their rights;
  • Name and objective of the database;
  • The way in which data is processed (manually or automatically);
  • Data Processing Policy (or privacy policy).

At the end of 2016, the Superintendence will proffer instructions for individuals, public entities, some mixed capital companies and private companies that are not subjected to the public registry before the Colombian chambers of commerce, in order to start their registration process.

Finally, information registered in the NDR must be updated within the first ten (10) days of each month and annually between January 2nd and March 31st, starting on 2018.

What happens if you don’t register your database?

The Superintendence of Industry and Commerce may impose on data controllers and processors different sanctions, including fines, suspension of activities related to the treatment of personal data, and temporary and definitive closure of operations involving the processing of personal data.

(Additional Reference: External Circular Letter No. 02 of the Superintendence of Industry and Commerce of Colombia)