Page 1

Print this rule

OFFICIAL DIARY. YEAR CL. N. 49150. 13, MAY, 2014. PÁG. 89.
INDEX [ Show ]

DECREE 886 OF 2014
(May 13)
by which article 25 of Law 1581 of 2012, relative to the National Registry of Databases, is regulated.
EFFECTIVE STATUS: Compiled. [ Show ]

Subtype: REGULATORY DECREE
The President of the Republic of Colombia, in use of his constitutional powers, and in particular those provided for in numeral 11 of article 189 of the Political Constitution and the paragraph of article 25 of the Law
1581 of 2012, and
CONSIDERING:
That by means of Law 1581 of 2012 the General Regime for the Protection of Personal Data was issued, which, in accordance with its article 1, aims to “(...) develop the constitutional right that they have
all people to know, update and rectify the information that has been collected about them in databases or files, and the other rights, freedoms and constitutional guarantees referred to in the
Article 15 of the Political Constitution; as well as the right to information enshrined in article 20 thereof ”.
That article 25 of Law 1581 of 2012 creates the National Registry of Databases, which is defined as the public directory of personal databases subject to Treatment that operate in the country,
administered by the Superintendency of Industry and Commerce and of free consultation for citizens.

That the paragraph of the aforementioned article 25 provides that the National Government will regulate the minimum information that the registry must contain, as well as the terms and conditions of registration to which they will be subject.
the Responsible for the Treatment.
That the Constitutional Court, through Sentence C-748 of 2011, declared the conditional constitutionality of article 25 of Law 1581 of 2012, for which it specified that the National Registry of Databases
“It must allow any person to determine who is processing their personal data in order to guarantee that the person can have effective control over their personal data by
to be able to know clearly and accurately on what bases your personal data is handled. Therefore, the National Government will have to resort to international standards and experience in its regulatory work.
of other States in the matter to achieve that the purpose described above of this registry is fulfilled ”.
That the National Registry of Databases will allow compliance with the legal obligation to publicize the existence of personal databases and will serve as a monitoring tool for the effective
protection of the rights of the holders.
DECREE:

CHAPTER I
General disposition

Article 1. Object. The purpose of this decree is to regulate the minimum information that the National Registry of Databases must contain, created by Law 1581 of 2012, as well as the terms and
conditions under which the Data Controllers must register in it.

Article 2. Area of ​application. The databases that contain personal data whose automated or manual treatment is carried out by
Natural or legal persons, of a public or private nature, in Colombian territory or outside of it, in the latter case, provided that the Data Controller or the Data Controller is
Colombian legislation applicable by virtue of international norms and treaties. The foregoing without prejudice to the exceptions provided in article 2 of Law 1581 of 2012.

Article 3. Duty to register the databases. The Responsible for the Treatment must register in the National Registry of Databases, independently, each of the databases that contain
personal data subject to treatment.

Article 4. Consultation of the National Registry of Databases. Citizens may consult in the National Registry of Databases, the minimum information provided for in article 5 of this decree with the
In order to facilitate the exercise of your rights to know, update, rectify, delete the data and / or revoke the authorization.

CHAPTER II
From the National Registry of Databases

Article 5. Minimum information from the National Registry of Databases. The minimum information that the National Registry of Databases must contain is the following:
1. Identification, location and contact details of the Data Controller of the database.
2. Identification, location and contact details of the person or persons in charge of the treatment of the database.
3. Channels for the holders to exercise their rights.
4. Name and purpose of the database.
5. Form of Treatment of the database (manual and / or automated), and
6. Information Processing Policy.
The Superintendency of Industry and Commerce, as the authority for the protection of personal data, may establish within the National Registry of Databases additional information to the minimum provided in this
article, in accordance with the powers conferred by Law 1581 of 2012 in literal h) of article 21.

Article 6. Responsible for the Treatment of the database. When the Responsible for the Treatment of the database is a legal person, it must indicate its name or Company Name and its number of
Tax identification, as well as your location and contact information. When the Data Controller is a natural person, they will enter their identification, location and contact details.

Article 7. Responsible for the Treatment of the Database. When the person in charge of the treatment of the database is or is a legal person, the person in charge of the treatment must
indicate in the National Registry of Databases the name or full business name and the tax identification number of said Manager or Managers, as well as their location and contact information.
When the Treatment Manager (s) is or is a natural person, their identification, location and contact data will be entered.

Article 8. Channels to exercise rights. They are the means of reception and attention of requests, queries and claims that the Responsible for the Treatment and the Person in Charge of the Treatment must make available
of the Holders of the information, with the respective contact details, through which the owner can exercise their rights to know, update, rectify and delete their personal data contained in
databases and revoke the authorization granted for the Treatment of them, when this is possible. These channels must provide, at least, the possibility for the owner to exercise their rights to
Through the same means by which your information was collected, recording the receipt and processing of the respective request.
In the cases in which the Data Processing is carried out by the Person in Charge, the Person in Charge of the Treatment will record the contact information of the Person in Charge so that the owner can advance before him the exercise of
your rights, without prejudice to the possibility that you have to go directly to the Data Controller.

Article 9. Name and purpose of the database. The Data Controller will identify each of the databases that you register, according to the purpose for which it was created.

Article 10. Forms of Treatment. The personal data contained in databases may be processed automatically or manually. Manual databases are the files whose information is
find organized and stored in a physical way and automated databases those that are stored and managed with the help of computer tools.

Article 11. Information Treatment Policy. The registration of the information treatment policy in the National Registry of Databases does not exempt the Responsible for the Treatment of their duty to
bring it to the attention of the Holders.
The minimum information that this policy must contain corresponds to that provided for in article 13 of Decree number 1377 of 2013.

CHAPTER III
Terms and conditions of registration in the National Registry of Databases

Article 12. Registration period. Those Responsible for the Treatment must register their databases in the National Registry of Databases within the year following the date on which the Superintendency of
Industry and Commerce enable said registry, in accordance with the instructions issued by that entity for that purpose. The databases created after that period must be registered within the
two (2) following months, counted from its creation.

Article 13. Registration of Databases. The Superintendency of Industry and Commerce will establish the registration procedure in the National Registry of Databases that must comply with the
Responsible for the Treatment, after validation of your identity, in accordance with what that entity establishes for this purpose.

Article 14. Updating of the information contained in the National Registry of Databases. Those Responsible for the Treatment of databases must update in the National Registry of Databases
Data the information registered when there are substantial changes, as defined by the Superintendency of Industry and Commerce.

Article 15. Sanctioning Power of the Superintendency of Industry and Commerce. The sanctioning power corresponds to the Superintendency of Industry and Commerce, when Law 1581 of 2012 is breached.

Article 16. Validity. This decree is effective as of its publication date in the Official Gazette .

Be published and enforced.
Given in Bogotá, DC, on May 13, 2014.
JUAN MANUEL SANTOS CALDERÓN
The Minister of Commerce, Industry and Tourism,
Santiago Rojas Arroyo.
The Minister of Information and Communication Technologies,
Diego Molano Vega.

