Colombia Regulatory Compliance Services

The framework addresses matters such as authorization, processing purposes, data quality, transparency, security, confidentiality, and individuals' rights to access and update their information and request correction or deletion where applicable. Decree 1377 of 2013, now incorporated into the relevant regulatory compilation, and other implementing provisions help operationalize the regime.

Organizations should assess whether their privacy program appropriately addresses:

• Personal data inventories and processing records.
• Privacy notices and policies for personal data processing.
• Valid authorization and other legally applicable processing conditions.
• Defined purposes for collecting and using personal information.
• Processes for handling access, correction, deletion, and other data subject requests.
• Data retention, secure deletion, and access controls.
• Contracts and responsibilities involving data processors.
• Security safeguards and internal accountability.
• Registration obligations for databases where applicable.
• International data transfers and transmissions.

Organizations handling credit records, financial histories, or related information should determine which rules apply to their activities and review:

• Information accuracy and updating procedures.
• Access and correction request workflows.
• Data reporting and disclosure practices.
• Responsibilities of information sources, operators, and users.
• Applicable retention and security arrangements.
• Sector-specific requirements for financial institutions and service providers.

Organizations using international cloud providers, outsourced services, global customer relationship management systems, or shared corporate databases should assess:

• The locations where personal data is stored and accessed.
• The roles of controllers and processors under the applicable framework.
• Whether an arrangement constitutes a transfer or transmission.
• The adequacy status of the destination country where relevant.
• Applicable exceptions, authorizations, or other permitted safeguards.
• Contractual protections and vendor oversight.
• Cross-border data flows involving multiple jurisdictions.

Organizations should determine which obligations apply to their operations rather than assuming that one set of cybersecurity requirements applies uniformly to all businesses.

Compliance activities may include:

• Cybersecurity risk assessments and control mapping.
• Access management and information security procedures.
• Incident detection, escalation, and response planning.
• Business continuity and recovery arrangements.
• Supplier and third-party security reviews.
• Evidence retention and incident documentation.
• Coordination between cybersecurity and personal data protection teams.

Relevant areas may include:

• Consumer-facing information and commercial disclosures.
• Advertising and representations about products or services.
• Online purchasing and contracting processes.
• Customer complaints and claims handling.
• Applicable cancellation, withdrawal, or refund rights.
• E-commerce-specific information requirements.
• Coordination between privacy notices and consumer-facing terms.

A practical website compliance review may include:

• Inventorying cookies and tracking technologies.
• Identifying data collected and the purposes of processing.
• Reviewing privacy policies and cookie disclosures.
• Assessing authorization or other legal requirements where applicable.
• Reviewing advertising and analytics vendors.
• Establishing appropriate retention and access controls.
• Checking whether website behavior matches published disclosures.

Compliance reviews may cover:

• Electronic contracting workflows.
• Electronic records and documentation practices.
• Electronic signature processes where relevant.
• Customer-facing terms and digital disclosures.
• Record retention and evidentiary requirements.
• Responsibilities of digital service providers.

Depending on the use case, governance measures may include:

• Documenting AI systems and their intended purposes.
• Assessing the personal data used to train or operate systems.
• Reviewing transparency and individual rights implications.
• Establishing human oversight and escalation procedures.
• Evaluating security, vendor, and operational risks.
• Monitoring relevant legislation, official guidance, and policy developments.

Relevant considerations include:

• Financial services and financial consumer protection.
• Telecommunications and digital communications.
• Healthcare and sensitive personal information.
• Employment and human resources data.
• Public-sector contracts and government-related services.
• International privacy requirements where their territorial scope applies.