Importance of implementing measures for demonstrated responsibility in the processing of Personal Data
The processing of personal data is a process regulated by Law 1581 of 2012 in Colombia, so it is recommended that from the beginning, your company has a process or documentation to support that it has acquired the necessary measures to comply with the requirements for the processing of data.
#Personal Data Processing
It is essential to keep in mind who is responsible for the Processing of Personal Data, and to have the ability to demonstrate this in case the Superintendency of Industry and Commerce requests it.
Implement appropriate and effective measures to comply with the obligations established in Law 1581 of 2012 and in Decree 1377 of 2013. (Incorporated in Decree 1074 of 2015) in Colombia.
According to the article “Guide on the Processing of Personal Data for Marketing and Advertising Purposes,” appropriate measures are those tailored to the needs of the data processing and effective in achieving the desired result or effect. In other words, inoperative, useless, pointless, or fruitless measures should not be adopted. Only those measures that are adequate, correct, useful, timely, and efficient should be implemented to comply with the legal requirements for processing personal data.
It is very important to emphasize that regulations on personal data impose evidentiary burdens on Data Controllers, such as the following:
- Evidence must be kept of having informed the data subject or owner, at the time of requesting authorization, in a clear and express manner, as ordered by Article 12 of Law 1581 of 2012 in Colombia and, if the Data Subject requires it, provide him with a copy of it.
- You must always request and keep, in accordance with the conditions set forth in this law, a copy of the respective authorization granted by the Holder.
- Being able to provide a description of the procedures used for the collection, storage, use, circulation and deletion of information, as well as a description of the purposes for which the information is collected and an explanation of the need to collect the data in each case.
- Having documentation on the procedures used for the processing, storage and deletion of personal data in accordance with the provisions applicable to the matter in question.
- Develop policies for the processing of personal data in your company and ensure that the Data Processors fully comply with them.
- Having a Privacy Notice template and maintaining its use to comply with the obligation to inform the owners of the information being processed. The existence of the information processing policy and how to access it, while personal data is being processed in accordance with it and the obligations arising from it remain in effect.
- To have the necessary and reasonable measures in place to ensure that the personal data held in databases is accurate and sufficient, in case the Data Subject or the Controller requests data to be updated, corrected or deleted, and that it complies with the purposes of the processing.
All of the above is supported under Article 22 of Decree 1377 of 2013 in Colombia
Companies engaged in marketing and advertising activities must have useful, appropriate, and effective measures in place to help them comply with their legal obligations. Furthermore, they must provide evidence and demonstrate their compliance. These tools should be subject to continuous review and evaluation to validate their effectiveness in ensuring compliance and the level of protection of personal data.
The challenge for companies regarding the Principle of Demonstrated Responsibility goes beyond simply issuing documents or drafting policies. It is an ongoing activity that requires demonstrating real and effective compliance in the practice of their work.
It is not enough to make symbolic declarations of good intentions; it is essential to demonstrate concrete results regarding the proper handling of personal data in marketing and advertising projects.
In conclusion
In conclusion, it is vital to conduct regular and specialized training sessions for company employees to provide them with the knowledge, guidance, and tools they need to properly perform tasks involving the "Processing of Personal Data.".
Fountain: SIC
#We invite you to read our blog post «"Customer-centric approach: What is it and what are the benefits for your business?"»
Learn about our Corporate Solutions
Learn about the IP telephony, multi-agent chat, and mass text and voice messaging solutions for your business.
Are your customers waiting too long? How to reduce response times without sacrificing quality
Read more ...
Common mistakes when implementing technology in customer service and how to avoid them
Read more ...
English 
Spanish