On 7 October 2025, the Superintendence of Industry and Commerce (SIC) issued the External Circular No. 002 of 2025 (“Circular”), establishing new guidelines and requirements for the registration of technology transfer contracts in Colombia in which personal data is transferred.
This Circular updates and clarifies the procedures for the registration, modification and cancellation of contracts involving technology transfer, technical assistance and trademark licenses, among others, in which personal data is transferred or the object is the processing of personal data.
Key points
The SIC instructs data controllers and data processors that process personal data of data subjects located in Colombia, in the context of technology transfer processes in which personal data are transferred or in which technologies that allow or have as object the processing of personal data are transferred, in the following obligations:
- Preliminary verification of regulatory compliance
- Technology providers and recipients must identify whether the transferred technology involves the processing of personal data and, if so, describe and characterize such functionalities.
- To assess that the technology complies with personal data protection regulations.
- If personal data are transferred as part of the process, compliance with the rules for international data transfers should be ensured, where applicable.
- Accountability
- Effective mechanisms in place to demonstrate compliance, such as:
- Identifying, measuring and controlling risks at all stages of personal data processing.
- Establish risk management systems proportionate to the impact on the right to data protection.
- Document decisions and mitigation measures taken.
- Define and execute corrective actions before implementing the transferred technology.
- Effective mechanisms in place to demonstrate compliance, such as:
- Include data protection by design and by default: In technology transfer processes, it is recommended to incorporate personal data protection measures by design and by default, as part of the principle of accountability. The technological architecture should integrate principles such as freedom, necessity, and confidentiality. Security measures must be adapted to the type of technology, context, and associated risks. Additionally, data collection should be limited to what is strictly necessary, promoting data minimization and anonymization or pseudonymization whenever possible.
- In contracts related to technology transfer, it is recommended to include clauses regarding the processing of personal data. These should define the responsibilities of the parties, technical and administrative measures to ensure data security, guarantees for international data transmissions, and mechanisms for supervision and auditing.
Click here to read the Spanish version
