Market Intelligence

Colombian data protection law imposes strict reporting deadlines and substantial penalties for cybersecurity incidents involving personal data. Companies face up to 15 business days to report breaches to the SIC and potential fines reaching 2,000 minimum wages, with enforcement extending beyond external attacks to everyday data management practices.

Colombia's Superintendence of Industry and Commerce has opened a public consultation to gather technical, legal, and practical perspectives on future identity validation mechanisms and personal data protection, with particular focus on preventing identity theft and impersonation. The initiative seeks input on biometric authentication technologies, secure data processing standards, and international best practices from financial entities, telecommunications operators, academia, and civil society.

As concerns about worker data privacy have grown across Latin America, so has the definition of "worker"; past, current, and potential employees and contractors may now be covered by a country's labor, employment and data-security regulations.

The above, without prejudice to the update that must be made within the 10 business days of each month when there are material changes to the registered information.

On March 11 of this year, the Financial Superintendence (SFC for its initials in Spanish), published the Circular Externa 005 of 2019 (Circular) titled Rules relative to the use of cloud based computing services.

On July 12, the Superintendence of Industry and Commerce issued a notice that 80 percent of legal entities required to register their database with the Superintendence have done...