The lineaments to follow for inclusion on the National Registry Databases were established

On 13 May; the Government issued Decree 886 of 2014, which regulated the Article 25 of Law 1581 of 2012, regarding the National Registry of Databases that was anticipated in this Law.

The most relevant items of the Decree as well as the most interesting ones for the accomplishment of the general regulation; for the in Colombia will be mentioned below.

1. Required subjects 

According to Article 2 of Decree 886 of 2014, the databases that contain personal data and its processing is done by natural or legal persons, public or private, are called to carry out the registration in the National Registry. Furthermore, the registration will make you the one responsible or in charge of the processing, when applicable Colombian law.

The purpose of the centralization of this kind of information is to facilitate data subjects to exercise their right to know who is processing their data. It is expected that the Superintendence of Industry and Commerce will issue specific rules for this registration starts being demanded.

2. Information that must be provided for registration of databases  

The Register shall include at least the following information:

I. Identification data, location and contact information of the data controller and the person responsible for the database process.

II. Channels for data subjects exercise their rights.

III. Name and purpose of the database.

IV. The way of the database is process.

V.  Information processing Policy.

It is important to note that completion of the registration does not replace the obligation of those responsible to inform all data subjects about the personal information processing policy.

In any case, the Superintendence of Industry and Commerce is authorized to require additional information to that requested by the Decree.  

3. Term to register your databases  

The existing databases before the entry into force of the Decree must enroll in the Registry "within one year from the date on which the Superintendence of Industry and Commerce enable the registry", as stated in article 12 of Decree 886 2014. However, if the databases are created after the period indicated above, the person in charge have a two-month period to register them. The term established will be counted from the creation of each database.

Finally, the regulation ratified that the Superintendence of Industry and Commerce is the competent authority to impose sanctions for breaches of the provisions of Law 1581 of 2012.