[co-author: Ana María Rodríguez]
The Superintendency of Industry and Commerce (Superintendencia de Industria y Comercio or SIC) of Colombia has reiterated the provisions of External Circular 003 of Aug. 1, 2018, emphasizing that companies and nonprofit entities with total assets exceeding 100,000 Tax Value Units (Unidades de Valor Tributario or UVT), equivalent to approximately US$1.1 million (around COP$5 billion) for the year 2025, as well as public legal entities, are required to register and keep updated the information in their personal databases in the National Database Registry (Registro Nacional de Bases de Datos or RNBD), in accordance with the provisions of Law 1581 of 2012.
For the year 2025, the obligated entities must update the information registered in the RNBD between Feb. 2, 2025, and March 31, 2025. Likewise, they must report, no later than Feb. 21, 2025, the claims filed by the holders of personal data during the second half of 2024 or notify the absence of new developments. Substantial changes in the registered information must be reported within the first 10 business days of the following month, and new databases must be registered within a maximum period of two months from their creation.
Failure to comply with these obligations may lead to administrative sanctions, including significant fines and compliance orders, measures that the SIC applies to guarantee the proper treatment of personal data.
