Personal data in contracts: what Ley 1581 asks of you

A contract is a document about a deal, and also a file of personal data. Names, ID numbers, signatures and addresses are all protected by Colombian law.

Teams focus on the commercial clauses and leave the data to a template paragraph nobody reads. That paragraph is where the risk is. This article explains what Ley 1581 de 2012, the general data protection law, means for the contracts your team handles.

Where personal data hides in a contract

• The parties and the people who sign for them.

• ID numbers (the cédula) and tax IDs of individuals.

• Contact details, addresses and bank accounts.

• Annexes that list employees, customers or users.

• Signature images, and the trail a signing platform keeps.

Some data is more sensitive than the rest. Biometric data, for example, is a special category with stricter rules, and it can appear if a signing method uses it.

The principles in plain words

Ley 1581 sets out principles that apply to any handling of personal data:

• Legality. Handle data only as the law allows.

• Purpose. Use data for the reason you gave when you collected it, and no other.

• Consent. Get the person’s prior, express and informed authorisation, unless the law says it is not needed.

• Truthfulness. Keep data accurate and up to date.

• Transparency. Let people know what you hold about them.

• Restricted access. Limit who can see and share the data.

• Security. Protect it against loss, misuse and unauthorised access.

• Confidentiality. Everyone who touches the data keeps it confidential.

Controller and processor

The law distinguishes the party that decides why and how data is used, the controller, from the party that handles it on the controller’s behalf, the processor. A contract should say which role each side has, because the duties are different. When a processor handles data for a controller, the regulation also asks for the arrangement to be written down.

The rights of the person

The people whose data you hold have rights you must be able to honour. Among them:

• to know, update and correct their data;

• to ask for proof of the authorisation they gave;

• to be told how their data has been used;

• to complain to the data protection authority, the Superintendencia de Industria y Comercio (SIC);

• to withdraw their authorisation and ask for their data to be deleted, where the law allows it.

Sending data abroad

The law restricts sending personal data to countries that do not offer an adequate level of protection, with exceptions. A cloud tool, a signing platform or a service provider with servers elsewhere can all count. Before you accept a clause that allows transfers, check where the data will go and on what basis.

Clauses to check in every contract

• What the data may be used for, and what it may not.

• Which party is the controller and which is the processor.

• The security measures each side must keep.

• Whether sub-processors are allowed, and who approves them.

• Whether data may leave Colombia, and under which safeguards.

• How and how fast a breach must be reported.

• What happens to the data when the contract ends: return, deletion or both.

• How long each side may keep records.

Keeping versus deleting

A signed contract usually has to be kept for the periods the law sets for commercial records, and that can pull against a request to delete. Decide in advance who resolves the tension, write the rule down, and apply it the same way every time. After the required period, delete or anonymise.

How Colibit handles it

Each organization’s data is kept apart from every other’s, and the organization always comes from the signed-in person, never from the request. Every change to a contract is recorded with who made it, so you can answer who touched what and when.

This article is general information, not legal advice.