On Marth 30th the Superintendence of Industry and Commerce (SIC) extended the deadline for updating the National Data Base Registry (“NDBR”) until July 3, 2020. If you have not yet updated the information of your databases in the RNBD, there is still time. Here are some general recommendations:

1. Coordinate internally. Check the inventory of the databases currently in use, confirm if you have new databases or if any of the ones you had registered no longer exist or are no longer used.
2. Update general information. Before you start, it will be important to update the general information of the company with the NDBR. In addition to basic contact information, it is essential to keep in mind the company’s total assets for the previous year, as well as two different contact emails. Remember that the main contact address needs to be easily accessible, it is important that you can coordinate the receipt of mail with whoever has access to that contact address.
3. Get complete information. Search and confirm all the information currently registered in the databases. One very important aspect is related to data processors, we have noticed that sometimes they are not registered, we recommend you verify this matter and get the complete information related to the data processors. It is essential to have its identification number, even if it is a foreign entity, and at least one contact channel for users for each of the data processors (e-mail, website, phone, address, etc.).
4. Verify information about external servers. Confirm with your IT area the location of the server where each of the data bases is stored, this is different from the location the data controller or the data processor as a company, the server can be your own or a third party’s, located in Colombia or in a country abroad.
5. Clean the registry. Once the above is done, you can start reviewing the registry. We recommend you perform a registry “cleaning” activity and remove from the system any databases you no longer have or use, from the last time you updated the registry. Remember that the deleted databases will no longer be shown to the public, but will not be deleted from the private registry, it will appear as “DISABLED”.
6. Update the information. Create new databases by manually increasing the number of records and editing the new “records” that have been created in your database list. Remember that the database will not be registered until you finish the process in the last step. Also, please note that it is possible to update the databases gradually; the system allows you to enter information as you get it confirmed it internally and finish the process later. It is also possible to finish the registration of one database and complete the others at the same time or later. Note that such update must be done before July 3rd, 2020.
7. Designate internal responsible persons. In the event that this is not implemented, we recommend that for each database you have, you designate a person within the organization who is responsible for it, so that someone is attentive to the fulfilment of the obligations relating to that database.

If you have any questions, contact us, we can help you.

The Database Calendar

Who is required to register their databases?

All public companies, as well as private companies and non-profit entities with total assets equal to or greater than COP$3,560,700,000 by 2019 (100,000 UVT).

What dates do you need to consider?

• If you have not registered your databases, register them as soon as possible.
• If you have a new database, register it within 2 months of its creation.
• If you have a security incident, report it within 15 business days of discovering it.
• If there are claims from data subjects, report them every six months, each February and each August within the first 15 business days of these months.
• If there are changes in the information registered except for the number of data subjects, register the change within the first 10 business days of the following month.
• Once a year, between January 2nd and March 31st, update all your databases. This year due to the emergency, there is time until July 3rd.

If you have any questions, contact us, we can help you.

Authors
María Alejandra De Los Ríos | [email protected] | Data Privacy & Protection
Mónica Moreno | [email protected] | Data Privacy & Protection