Data protection and technology
Personal data processing, international transfers, technology contracts and cybersecurity.
Law 1581 of 2012 governs the processing of personal data in Colombia, and the Superintendence of Industry and Commerce (SIC, the data protection and competition authority) enforces it through inspection visits, inquiries and fines. Every company that collects data from customers, employees or suppliers is a data controller: it needs the data subjects' authorization, a published policy, a procedure for handling requests and complaints and, above the thresholds set by the Government, registration of its databases in the National Database Registry.
We advise on compliance with that law and with Law 1266 of 2008 on financial and credit data, on international data transfers and transmissions, and on the legal response to security incidents. We also draft and negotiate the contracts that sustain a company's technology operations: software licenses, cloud services, development, support and outsourcing.
We work with our clients' technology and information-security teams so that legal obligations are reflected in processes, not only in documents.
What we do
- Data processing policies, privacy notices and authorization forms.
- Registration and updating of databases in the SIC's National Database Registry.
- Data transmission agreements with data processors and international data transfers.
- Handling of data subjects' requests, complaints and claims, and of SIC inquiries and investigations.
- Legal management of security incidents: assessment, notification to the authority and communication to data subjects.
- Software license, cloud services, development and maintenance agreements.
- Service level agreements, confidentiality agreements and ownership of developed software.
- Legal review of projects involving biometric data, video surveillance, geolocation and profiling.
- Compliance with Law 1266 of 2008 when querying and reporting to credit bureaus.
- Legal framework for the use of artificial intelligence tools with personal data.
Questions we answer
- Can I send our customer database to the parent company abroad or to a cloud provider?
- A former employee is asking us to delete all of his information. Are we required to?
- How long can I keep the data of a customer who no longer buys from us?
- We suffered unauthorized access to our systems. Whom must we notify and by when?
- Can I use cameras and facial recognition to control access to the plant?
- Who owns the software that a contractor developed for us?
Let's talk
Tell us the decision you have to make. We reply the same business day.
Write to us