New deadline for updating information in the RNBD

The addressees of the External Circular are the parties obliged to update the information registered in the National Registry of Databases, in accordance with the regulations applicable to the matter.

We remind you that the National Database Registry was created by Law 1581 of 2012, by which general provisions are issued for the protection of personal data, whose administration will oversee the Superintendence of Industry and Commerce and will be of free consultation for citizens.

The National Government regulated the registry through Decree 886 of 2014, unified in the Single Decree 1074 of 2015, determining the minimum information that the Registry must contain, as well as the terms and conditions under which data controllers must register in this registry.

After that, the National Government by means of Decree 090 of January 18, 2018, modified the scope of application of the National Database Registry and created new deadlines for the subjects that are obliged to register their databases.  In accordance with the provisions of said Decree, the general regime for the protection of personal data, Law 1581 of 2012, is applicable to all companies and entities in Colombia. Notwithstanding the above, it was determined that the registration process in the RNBD must be carried out only by "Companies and non-profit entities that have total assets exceeding 100,000 Tax Value Units (UVT) and legal entities of a public nature" [1].

Likewise, the Decree regulated the deadlines for the registration of databases in the RNBD, also stating that the databases created after the expiration of such deadlines should be registered within two (2) months after their creation.

In relation to the updating of substantial changes such as: (i) those related to the purpose of the database; (ii) the Data Processor; (iii) the channels of attention to the Data Subject; (iv) the classification or types of personal data stored in each database; (v) the information security measures implemented; (vi) the Information Processing Policy; (vii) the international transfer and transmission of personal data; and, (viii) the claims filed. The Sole Circular of the Superintendence of Industry and Commerce (SIC) regulates the deadlines as follows:

"Data controllers that in accordance with the provisions of Decree 090 of January 18, 2018, are required to register their databases in the RNBD must update the registered information, as follows:

(i) Within the first ten (10) business days of each month, as of the registration of the database, when substantial changes are made to the registered information.

(ii) Annually, between January 2 and March 31, as of 2020. (...)

Additionally, within the first fifteen (15) working days of the months of February and August of each year, as of their registration, the data controllers who are obliged to register their databases in the RNBD must update the information on the claims submitted by the Data Subjects, referred to in number (i) of paragraph f) of numeral 2.1 above.

The first report of claims submitted by Data Subjects shall be made in the second half of 2019 with the information corresponding to the first half of 2019. Data controllers who are not obliged to register their databases and who carried out such procedure, are not obliged to carry out the update referred to in this numeral and the information registered by them will not be available for public consultation."

This modification of deadlines for updating the information registered in the RNBD is nothing more than another strategy of the National Government to avoid the contagion of COVID-19, since obtaining such data implies, in some cases, the displacement of persons to the headquarters of their companies or entities.

[1] Article 2.2.2.2.26.1.2 of Decree 1074 of 2015, modified by Article 1 of Decree 090 of January 18, 2018.