{"id":15139,"date":"2025-08-04T15:45:19","date_gmt":"2025-08-04T20:45:19","guid":{"rendered":"https:\/\/nexo.legal\/?p=15139"},"modified":"2025-08-04T17:09:02","modified_gmt":"2025-08-04T22:09:02","slug":"habeas-data-business-in-colombia","status":"publish","type":"post","link":"https:\/\/nexo.legal\/es\/habeas-data-business-in-colombia\/","title":{"rendered":"\u00bfTu empresa maneja datos personales? Esto es lo que debes saber tras la nueva circular de la SIC"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Do you have a <\/span>business in Colombia<\/b>?\u00a0<\/span><\/p>

Then there\u2019s something you can\u2019t overlook: the processing of personal data from your clients, providers, employees, or users.<\/span><\/p>


<\/span>And it\u2019s not just a best practice \u2014 it\u2019s a legal obligation.<\/span><\/p>

The Superintendence of Industry and Commerce (SIC) has just issued a new circular with clear instructions for companies \u2014 and especially for their administrators \u2014 on how to manage these data responsibly and securely.<\/span><\/p>


<\/span>We\u2019ll explain what this new regulation says and how it can directly impact the operation of your <\/span>business in Colombia<\/b>.<\/span><\/p>

What is this new circular about?<\/b><\/h2>

The SIC updates the manual: the rules of the game on data protection are now clearer (and more demanding).<\/span><\/p>


<\/span>External Circular No. 003 of August 23, 2024<\/b>, issued by the Superintendence of Industry and Commerce (SIC), reinforces the obligations of corporate administrators regarding the protection of personal data.<\/span><\/p>

This applies to any natural or legal person who manages, represents, or runs a company.<\/span><\/p>

Although the circular does not change the law, it does clarify how companies must act when handling personal data, in accordance with the principle of <\/span>accountability<\/b>, which requires not only complying with the regulations, but also being able to demonstrate that compliance through proper policies, procedures, and records.<\/span><\/p>

What is considered \u201cprocessing of personal data\u201d?<\/b><\/h2>

You don\u2019t need to have a massive database to be required to comply with data protection regulations.<\/span>
<\/span>Just by storing or using a person\u2019s information, you are already processing personal data.<\/span><\/p>

This includes any action such as collecting, storing, using, sharing, or deleting that information.<\/span><\/p>

Data processing includes any action you take with information such as:<\/span>
<\/span>\u2013 Full names<\/span>
<\/span>\u2013 Email addresses<\/span>
<\/span>\u2013 Contact numbers<\/span>
<\/span>\u2013 Medical history<\/span>
<\/span>\u2013 Location<\/span>
<\/span>\u2013 Employment or financial data<\/span><\/p>

In other words:<\/b> if you have an Excel sheet with customer information, you\u2019re already processing personal data and are subject to this regulation \u2014 regardless of the size of your <\/span>business in Colombia<\/b>.<\/span><\/p>

What is the SIC reminding companies about?<\/b><\/h2>

Protecting personal data is not optional, nor is it just about placing a notice on your website.<\/span>
<\/span>It is a real responsibility for any company. The SIC is reminding companies that the right to <\/span>habeas data<\/b> must be taken seriously, which means:<\/span><\/p>

\u2705 You must inform individuals that you are going to process their personal data and obtain their consent<\/span>
<\/span>\u2705 You must have clear internal policies to protect personal data<\/span>
<\/span>\u2705 You must apply preventive corporate measures \u2014 not wait until there\u2019s a complaint or a sanction<\/span>
<\/span>\u2705 You must demonstrate that you comply with the law \u2014 not just say that you do<\/span><\/p>

The circular brings back the principle of <\/span>accountability<\/b>: it\u2019s not enough to comply \u2014 you must be able to prove that you are doing so. This applies to any <\/span>business in Colombia<\/b> that collects or manages personal data in any form.<\/span><\/p>

What does the Constitution say about it?<\/b><\/h2>

This circular didn\u2019t come out of nowhere \u2014 it has a constitutional foundation.<\/span><\/p>

The SIC relies on several key articles of the Political Constitution of Colombia:<\/span>
<\/span>Article 15:<\/b> The right to privacy and good name<\/span>
<\/span>Article 333:<\/b> Free enterprise has a social function<\/span>
<\/span>Article 2:<\/b> The State must protect fundamental rights<\/span><\/p>

This means that data protection is not just an administrative or commercial issue, but also a matter of <\/span>human rights<\/b> and <\/span>corporate social responsibility<\/b>, especially for those running a <\/span>business in Colombia<\/b>.<\/span><\/p>

What should companies do?<\/b><\/h2>

It is essential to create or update your privacy policies, contracts, and all documents related to the handling of personal data.<\/span><\/p>

With the new circular, all companies must ensure they have:<\/span>
<\/span>\u2013 A privacy policy<\/span>
<\/span>\u2013 A cookie policy<\/span>
<\/span>\u2013 A personal data processing policy<\/span>
<\/span>\u2013 And, if applicable, image use authorization<\/span><\/p>

These policies must be <\/span>clear, visible, and accessible<\/b> to all individuals whose data you collect.<\/span>
<\/span>They must also be disclosed through the same channels where the data is collected, ensuring compliance with the principle of <\/span>accountability<\/b>.<\/span><\/p>

It\u2019s not just about having documents: they must be implemented effectively \u2014 especially if you want to avoid legal issues in your <\/span>business in Colombia<\/b>.<\/span><\/p>

In addition:<\/b>
<\/b>– <\/b>You must implement real information security protocols.<\/span>
<\/span>– You must obtain clear and verifiable consent from your users or clients.<\/span>
<\/span>– You must regularly clean your database, removing any information that is no longer necessary for your operations \u2014 and keep a documented record of this process.<\/span>
<\/span>– You must have communication channels in place so that users, employees, providers, and others can report any concerns or updates regarding the use of their personal data.<\/span>
<\/span>– You must be able to respond to any request from the SIC by demonstrating that you comply with the law.<\/span><\/p>

This applies whether you’re a large company with thousands of users \u2014 or a small business that stores client data in a spreadsheet.<\/span><\/p>

What if you don\u2019t comply?<\/b><\/h2>

The SIC is no longer just making recommendations \u2014 it can now impose <\/span>economic sanctions<\/b> on companies that fail to meet these obligations.<\/span><\/p>

Failing to comply with these requirements can lead to <\/span>fines, investigations, and serious legal issues<\/b>.<\/span><\/p>

In recent years, the SIC has already sanctioned multiple companies for selling databases, not protecting user information, or failing to respond appropriately to data update or deletion requests.<\/span><\/p>

What can you do right now?<\/b><\/h2>

Don\u2019t wait until there\u2019s a problem to act.<\/span><\/p>

\ud83d\udc49 Conduct an internal audit of how your company uses data<\/span>
<\/span>\ud83d\udc49 Make sure you have clear data processing and privacy policies<\/span>
<\/span>\ud83d\udc49 Train your team on data protection<\/span>
<\/span>\ud83d\udc49 Align your operations with what the circular requires<\/span><\/p>

Do you have questions about how your company handles personal data? Write to us.<\/b>
<\/b>We\u2019ll help you evaluate your compliance level and implement real protection measures for your <\/span>business in Colombia<\/b>.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t