Data protection and privacy periodic obligations: annual update, and report on data subjects’ claims second semester 2022
Be reminded that as established by the General Circular of the Superintendency of Industry and Commerce, data controllers which are obliged to register their data bases within the National Data Base Registry (NDBR) must perform at the beginning of each year, the annual update of the said registry. Such update must be done between January 2nd and March 31st every year. Your company is on time to comply with this obligation.
The mentioned updates must include any change that the data base has suffered within the previous year, i.e. if the number of data subjects included in the data base changed, if there was any change on the corporate name of the data controller, among others.
Please note that substantial changes, such as those related with the purposes to handle data, the data processor, the attention lines, classification and types of personal data, and international data transfers and transmissions, must be reported within the first 10 business days of the month in which the changes took place.
If by the time of the annual update there are any substantial changes that have not been registered those should be registered at the annual update.
Also, it is necessary that within the first fifteen (15) business days of February, which means that no later than on February 21st, 2023, the data controllers perform the corresponding report of claims presented by data subjects in the previous semester (July to December 2022) must be reported.
We look forward to any queries that you may have, or to support your team on the compliance with the abovementioned obligations.
Author: María Alejandra De Los Ríos I mdelosrí[email protected] I Data Protection & Privacy
