Colombian Draft Regulation Introduces Accountability Principle To Data Transfers
Under Colombia's data protection framework, any country outside of Colombia is classified as a "third country”, and therefore, personal data can only be transferred to another country when an adequate level of protection is guaranteed.
There are several options that can show adequate data protection, including the Colombian Superintendencia of Industry and Commerce to give consent, if an exception is made, a statement is issued regarding the intent to transfer data, and last, to create and use binding corporate rules.
Last, it's important to note that Colombian draft regulation will only apply to the transfer of personal data between a controller and another controller. The draft regulation is expected to be approved in September.