Page 1

Administrative Department of the Public Function

Decree 90 of 2018
The published data is for informational purposes only. The Administrative Department of the Public Function does not
is responsible for the validity of this standard. We are in a permanent process of updating the
contents.

DECREE 090 OF 2018

(January 18)

Whereby articles 2.2.2.26.1.2 and 2.2.2.26.3.1 of Decree 1074 of 2015 - Sole Regulatory Decree of the Sector are modified
Commerce, Industry and Tourism

THE PRESIDENT OF THE REPUBLIC OF COLOMBIA

In exercise of its constitutional and legal powers, especially those conferred in paragraph 11 of article 189 of the Constitution
Politics, and article 25 of Law 1581 of 2012, and

CONSIDERING

That article 2.2.2.26.1.2 of Decree 1074 of 2015, establishes the scope of application of the National Registry of Databases, created
by Statutory Law 1581 of 2012 "By which general provisions are issued for the protection of personal data" , which includes
databases containing personal data whose automated or manual processing is carried out by natural or legal persons,
of a public or private nature, in the Colombian territory or outside of it, provided that the Responsible or the person in charge of the treatment is
Colombian legislation applicable by virtue of international norms and treaties.

That article 2.2.2.26.3.1 of Decree 1074 of 2015 establishes the deadline for Data Controllers to register their bases of
data in the National Registry of Databases, in accordance with the instructions issued by the Superintendency of
Industry and Commerce, entity that is in charge of the administration of the National Registry of Databases.

That in response to multiple requests received by the aforementioned Superintendency, the deadline for
registration initially established so that those Responsible for the Treatment of personal information could register their databases
in said registry, in order to increase the disclosure and socialization of this legal obligation and guarantee a high degree of compliance
of the aforementioned provision among the addressees of the standard.

That despite the disclosure and socialization of this obligation carried out by the Superintendency of Industry and Commerce within the
terms of extension of the aforementioned term, the number of Treatment Managers who have registered their databases represents only the
twenty-five percent (25%) of the total number of legal entities and less than one percent (1%) of natural persons.

Taking into account prioritization criteria according to the risks in the management of personal information, the burden assumed by
the subjects obliged to carry out the registration of their databases, as well as the results obtained in the registration process of such
information to date, it is necessary to modify the scope of application and the term indicated in articles 2.2.2.26.1.2 and
2.2.2.26.3.1 of Decree 1074 of 2015, in order to reduce the universe of supervised persons who must comply with the special obligation of
register their databases in the system established by the Superintendency of Industry and Commerce and guarantee a high degree of

Decree 90 of 2018

1

EVA - Regulatory Manager

Page 2
Administrative Department of the Public Function
compliance with this legal obligation.

That Law 905 of 2004, modified by Law 1111 of 2006, establishes in article 2 the parameters based on which the
Micro, Small and Medium Enterprise, within which the value of total assets is included as follows: i) Medium Enterprise: Total assets per
value between 100,000 to 610,000 Tax Value Units (UVT); ii) Small Business: Total assets worth between five hundred and one (501)
and less than five thousand (5,000) current legal monthly minimum wages and, iii) Microenterprise: Total assets excluding housing by value
less than five hundred (500) current legal monthly minimum wages.

That, in order to limit the universe of those surveyed who must comply with the obligation to register their databases, the
parameter provided in Law 905 of 2004 regarding total assets, to exclude non-profit companies and entities that
comply with the provisions for micro and small businesses. Likewise, natural persons will be excluded.

That by virtue of the modification of the scope of application, those Responsible for the treatment that are not obliged to carry out the registration
of their databases in the RNBD, but who have already carried out this procedure, they will not be obliged to carry out the update that the
Article 2.2.2.26.3.3 of Decree 1074 of 2015 - Sole Regulatory Decree of the Commerce, Industry and Tourism sector and information
registered will not be available for consultation.

That the limitation of the universe of those surveyed compared to the duty to register their databases does not imply in any way that people
legal and natural laws that are exempted from making said registration by means of this decree are relieved of compliance with the
Other duties established for those Responsible for the Processing of personal data. Consequently, while they are not required to
register their databases with the Superintendency of Industry and Commerce, they are still subject to compliance with the provisions
contained in Law 1581 of 2012.

That the regulations of this Decree were submitted to Public Consultation for a term of fifteen (15) days, in accordance with the
provided in article 8 of Law 1471 of 2011 and Decree 270 of 2017.

DECREE

ARTICLE 1. Modify article 2.2.2.26.1.2 of Decree 1074 of 2015 - Sole Regulatory Decree of the Commerce, Industry and
Tourism, which will be like this:

"ARTICLE 2.2.2.26.1.2. Scope of application. The databases
that contain personal data whose automated or manual Treatment is carried out by the Data Controllers who collect
the following characteristics:

a) Non-profit companies and entities that have total assets of more than 100,000 Tax Value Units (UVT). •

b) Legal persons of a public nature ".

ARTICLE 2. Modify article 2.2.2.26.3.1 of Decree 1074 of 2015 - Sole Regulatory Decree of the Commerce, Industry and
Tourism, which will be like this:

"ARTICLE 2.2.2.26.3.1. Registration period. The registration of the databases in the National Registry of Databases will be carried out
carried out in the following terms:

a) The Data Controllers, companies and non-profit entities that have total assets of more than 610,000 Units
of Tax Value (UVT), they must make the aforementioned registration no later than September thirty (30), in accordance with the
instructions given by the Superintendency of Industry and Commerce;

Decree 90 of 2018

two

EVA - Regulatory Manager

Page 3
Administrative Department of the Public Function

b) The Data Controllers, companies and non-profit entities that have total assets of more than 100,000 and up to
610,000 Units of Tax Value (UVT), must make the aforementioned registration no later than November thirty (30), 2018,
compliance with the instructions issued by the Superintendency of Industry and Commerce;

c) The Data Controllers, legal persons of a public nature, must make the aforementioned registration no later than the
January thirty-one (31), in accordance with the instructions issued by the Superintendency of Industry and Commerce.

The databases that are created after the expiration of the terms referred to in literals a), b) and c) of this article,
they must register within the following two (2) months, counted from their creation ".

ARTICLE 3. Validity and repeal. This decree governs from its publication and repeals all provisions that may be applicable to it.
contrary.

GET PUBLISHED AND ENFORCED

Given in Bogotá DC, on the 18th day of the month of January of the year 2018

DANIEL ARANGO ANGEL

THE VICE MINISTER OF BUSINESS DEVELOPMENT IN CHARGE OF THE FUNCTIONS OF THE OFFICE OF THE MINISTER OF TRADE,
INDUSTRY AND TOURISM,

Note: Published in Official Gazette No. 50.480 of January 18, 2018

Creation date and time: 2021-06-05 14:45:10

Decree 90 of 2018

3

EVA - Regulatory Manager

