Personal Data Treatment Policy
In this section, you will find all the information that Universidad Industrial de Santander has made available to the public regarding the Administrative Procedures Manual for the Processing of Personal Data.
RESOLUTION
1013 of 2026
Approving the Administrative Procedures Manual for the Processing of Personal Data of Universidad Industrial de Santander.
THE ACADEMIC VICE-RECTOR’S OFFICE OF UNIVERSIDAD INDUSTRIAL DE SANTANDER,
in the exercise of the Rector’s statutory functions in the absence of the incumbent, pursuant to Article 33 of the General Statute of Universidad Industrial de Santander, and
WHEREAS:
- Pursuant to paragraph (m) of Article 30 of the General Statute of Universidad Industrial de Santander, the Rector is responsible for issuing the Institution’s manuals of functions, requirements, and administrative procedures.
- Article 15 of the Political Constitution recognizes the fundamental right to habeas data and guarantees all persons the right to access, update, rectify, and delete information concerning them that is stored in databases or files.
- Statutory Law 1581 of 2012 established the general personal data protection regime and set forth the principles, rights, duties, and procedures applicable to the processing of personal data by public and private entities.
- The National Government consolidated the regulations governing the personal data protection regime in Decree 1074 of 2015, the Single Regulatory Decree for the Commerce, Industry, and Tourism Sector, which incorporated and updated the relevant regulatory provisions, as well as the obligations related to the National Database Registry and information processing policies.
- Through Resolution No. 1227 of August 22, 2013, Universidad Industrial de Santander approved the Administrative Procedures Manual for the Processing of Personal Data in order to comply with the obligations established in Law 1581 of 2012 and the regulations in force at that time.
- Nearly thirteen (13) years after the adoption of the aforementioned Manual, the University has identified the need to comprehensively update this instrument in order to incorporate regulatory, jurisprudential, and doctrinal developments in the field of personal data protection; strengthen the institutional culture of compliance; align its content with the Quality Management System and the institutional information security and privacy policies; and respond to the new dynamics arising from the digital transformation of university processes.
- The updated Manual sets out the rights of personal data subjects with greater precision; defines in detail the responsibilities of the data controller and data processors; strengthens institutional mechanisms for handling inquiries, complaints, and security incidents; incorporates criteria for the processing of sensitive data and the personal data of children and adolescents; regulates the management of institutional databases; establishes the role of the Personal Data Protection Officer; and creates the Institutional Committee for the National Personal Database Registry, with the aim of consolidating a preventive and continuous improvement model for personal data protection.
- It is necessary to strengthen the institutional culture regarding the proper processing of personal data managed by the University by promoting compliance with the principles of legality, purpose limitation, transparency, security, confidentiality, and accountability, as well as the adoption of sound administrative practices for the collection, storage, use, circulation, retention, and deletion of information provided by students, faculty members, public servants, pensioners, contractors, suppliers, alumni, and other personal data subjects.
- The Institutional Management and Performance Committee of Universidad Industrial de Santander reviewed this initiative and issued a favorable opinion regarding its adoption.
In view of the foregoing,
RESOLVES:
ARTICLE 1. To approve the Administrative Procedures Manual for the Processing of Personal Data of Universidad Industrial de Santander, the text of which forms an integral part of this Resolution.
ARTICLE 2. The Manual approved by this Resolution shall be mandatory for all academic and administrative units of the University, as well as for public servants, faculty members, contractors, and any other persons who, in the performance of their duties or activities, are involved in the processing of personal data under the responsibility of the Institution.
ARTICLE 3. The General Secretariat shall ensure the permanent publication of the Manual on the institutional website and shall take the necessary measures to guarantee its dissemination and accessibility to the university community and personal data subjects.
ARTICLE 4. University units shall undertake the administrative, technical, and operational actions necessary to implement the provisions contained in the Manual approved by this Resolution and, where applicable, update the procedures, protocols, forms, and other Quality Management System documents related to the processing of personal data.
ARTICLE 5. Resolution No. 1227 of August 22, 2013, is hereby repealed in its entirety, along with any other provisions that are contrary to this Resolution.
ARTICLE 6. This Resolution shall enter into force on the date of its publication.
TO BE PUBLISHED, COMMUNICATED, AND COMPLIED WITH.
Issued in Bucaramanga on the twenty-seventh (27th) day of July 2026.
ACADEMIC VICE-RECTOR, OLGA MERCEDES ÁLVAREZ OJEDA
ACTING SECRETARY GENERAL, CÉSAR AUGUSTO QUIJANO QUIROGA
ADMINISTRATIVE PROCEDURES MANUAL FOR THE
Processing of Personal Data
• ARTICLE 1. Purpose and Scope
The purpose of this Manual is to establish the procedures for guaranteeing the right to habeas data of all natural or legal persons who provide information to UIS as a result of employment, academic, or commercial relationships. The provisions contained herein shall comply with Article 15 of the Political Constitution, Law 1581 of 2012, Decree 1074 of 2015, and any provisions that amend, replace, or supersede them.
Paragraph. The provisions of this Manual shall apply to all University units, including UISALUD and Student Welfare, with respect to the processing of personal data, including data contained in medical records and other information subject to legal confidentiality requirements. Notwithstanding the foregoing, these units may adopt specific protocols, procedures, or regulations governing matters particular to their activities and the nature of the information they manage. Such provisions shall be complementary and shall be interpreted consistently with the provisions of this Manual.
• ARTICLE 2: Definitions
For the purposes of the application and interpretation of this Manual, the following terms shall have the meanings set forth below:
2.1. Authorization: Prior, express, and informed consent granted by the data subject to allow the processing of their personal data. As a general principle, data processing requires such authorization; however, there are legal exceptions, such as those arising from employment, administrative, or contractual relationships, or where otherwise provided by law.
2.2. Privacy Notice: Written communication issued by the data controller and addressed to the data subject regarding the processing of personal data, informing the data subject of the existence of the information processing policies applicable to them, how to access such policies, and the purposes for which the personal data are intended to be processed.
2.3. Database: An organized collection of personal data that is subject to processing. A database exists when information is structured according to specific criteria, regardless of the medium in which it is stored, whether digital or physical.
2.4. Temporary Databases: Databases generated in the course of day-to-day operational activities from copies or extracts of primary databases for specific purposes. Such databases shall be subject to security measures appropriate to the nature of the information and shall be deleted or integrated into institutional systems once they are no longer needed.
2.5. Data Disclosure or Transfer: The provision or disclosure of personal data to a natural or legal person other than the data subject. As a general rule, this action requires the data subject’s authorization, except in the cases provided for by law.
2.6. Unequivocal Conduct: Any manifestation of behavior from which it may reasonably be inferred that the data subject has granted authorization for the processing of their data. It does not replace the requirement for prior, express, and informed authorization but may constitute evidence of the data subject’s intent.
2.7. Personal Data: Any information that identifies or makes it possible to identify a natural person. In the context of UIS, this includes data relating to students, faculty members, alumni, public servants, contractors, suppliers, and participants in institutional activities. In institutional documents, references to personal data shall be understood to encompass all categories established under Colombian law, namely public data, semi-private data, private data, and sensitive data, to which the rules and levels of protection established under applicable legislation shall apply.
2.8. Private Data: Data that, due to its intimate or confidential nature, is relevant only to the data subject. It is not in the public domain, but its processing does not inherently pose a risk of social discrimination or infringement of fundamental rights. This category includes information such as a residential address or personal telephone number.
2.9. Public Data: Data that is not intimate, confidential, or private in nature. Public data include, among others, information concerning a person’s marital status, profession or occupation, and status as a public servant, as well as information contained in public documents, official gazettes and bulletins, and final court judgments that are not subject to confidentiality restrictions.
2.10. Semi-Private Data: Data that is neither intimate or confidential nor public in nature, and whose disclosure may be of interest not only to the data subject but also to a particular sector of society, such as financial and credit data and academic information.
2.11. Sensitive Data: Data that affects the privacy of the data subject or whose improper use may result in discrimination, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union or social organization membership, health-related data, information concerning sexual life, and biometric data.
2.12. Open Data: All primary (unprocessed) data available in standard and interoperable formats that facilitate access and reuse, which are held by public entities and made freely available to any citizen without restrictions, so that third parties may reuse them and create derivative services.
2.13. Data Processor: A natural or legal person, whether public or private, that processes personal data on behalf of the data controller. In the case of Universidad Industrial de Santander, all public servants, collaborators, or contractors who access third-party personal data in the performance of their duties, obligations, and responsibilities shall be considered data processors.
2.14. Purpose: The specific purpose for which personal data are collected and used. Clearly defining the purpose is essential to ensuring the lawfulness of the processing.
2.15. Habeas Data: The fundamental right of individuals to access, update, rectify, and delete their personal information and data that have been collected and/or processed in public or private databases, in accordance with the law and other applicable regulations.
2.16. Data Protection Officer: The person or unit responsible for leading, coordinating, and overseeing compliance with the institutional personal data protection policy. The appointment of a Data Protection Officer does not exempt the University, as data controller, or the data processors from their respective responsibilities.
2.17. Data Controller: A natural or legal person who determines the collection and use of personal data. For the purposes of this policy, Universidad Industrial de Santander acts as the data controller for the personal data under its administration.
2.18. Data Subject: The natural person to whom the personal data being processed belong. The rights established by law may be exercised by: 1. the data subject, upon verification of their identity; 2. their successors in interest, upon proper verification; and 3. their legal representatives or authorized representatives, where applicable.
2.19. Data Transfer: The sending of personal data to a third party located within or outside the national territory, who becomes the new data controller. In such cases, the University shall ensure that the recipient complies with appropriate information protection standards.
2.20. Data Transmission: Processing involving the disclosure of personal data to a data processor, within or outside the country, so that the processor may process such data solely on behalf of and for the account of the data controller. The University retains its status as data controller and is jointly responsible with the data processor for the proper handling of the information.
2.21. Data Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, updating, or deletion.
2.22. Users: Persons or systems authorized to access personal data managed by the University. They may be internal or external, depending on their functions and assigned level of access.
ARTICLE 3: Identification of the Data Controller
Universidad Industrial de Santander, identified by Tax Identification Number (NIT) 890.201.213-4, is a public higher education institution established by Ordinance No. 83 of June 22, 1944, issued by the Santander Departmental Assembly, with its principal place of business in the city of Bucaramanga, Santander. It acts as the data controller for the personal data of all natural persons associated with the University in the performance of its core functions of teaching, research, and outreach.
Data subjects may exercise their rights through the following service channels:
In-Person Assistance: Internal Control and Management Evaluation Office (Sede Central Cra. 27 calle 9, Bucaramanga, Edificio Administración 2, piso 2, oficina 203) and the administrative offices of the Academic-Administrative Units. If a request is received in person by an Academic-Administrative Unit, the staff member responsible shall register it directly in the PQRSDF system or complete Form FSE.06 – Receipt of Petitions, Complaints, Claims, Suggestions, Reports, and Compliments (PQRSDF), as established in Procedure PSE.04 – Procedure for Petitions, Complaints, Claims, Reports, Suggestions, and Compliments.
Telephone Assistance: : PBX (607) 6344000 and national toll-free number 018000111641.
Email:
- Correo electrónico: protecciondatos@uis.edu.co managed by the Data Protection Officer.
Petitions, Complaints, Claims, Suggestions, Reports, and Compliments Information System (PQRSDF): available on the institutional website: https://www.uis.edu.co/sipqrsPublico/home.seam
- Correspondence: Reception office located at the Carrera 30 entrance gate, logistics building, main campus of the University.
ARTICLE 4: Governing Principles of Data Processing
In addition to the principles governing the administrative function established in Article 209 of the Political Constitution of Colombia—particularly the principles of equality, morality, effectiveness, economy, promptness, impartiality, and transparency—the following specific principles are adopted for the purposes of this Manual and, more generally, for the processing of personal data at Universidad Industrial de Santander, in accordance with applicable regulations:
4.2. Principle of Purpose Limitation: Data processing must serve a legitimate purpose consistent with the Constitution and the law, and such purpose shall be clearly communicated to the data subject.
4.3. Principle of Freedom: Data processing may only be carried out with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without authorization, except where a legal or judicial mandate exempts such processing from the consent requirement.
4.4. Principle of Accuracy or Quality: Information subject to processing shall be truthful, complete, accurate, up to date, verifiable, and understandable. The processing of partial, incomplete, or misleading data is prohibited.
4.5. Principle of Transparency: Data subjects shall be guaranteed the right to obtain, at any time and without undue restrictions, information regarding the existence and use of personal data concerning them.
4.6. Principle of Restricted Access and Circulation: The processing of personal data shall be subject to the limitations arising from the nature of the data, the Constitution, and the law. Accordingly, information may only be accessed by persons authorized by the data subject or those legally authorized to do so. Except for information of a public nature, personal data may not be made available on the Internet or through other means of mass dissemination unless technical mechanisms are in place to restrict access exclusively to data subjects or third parties authorized in accordance with the law. Data may also be made freely accessible if they have been previously anonymized in such a way that re-identification is impossible, since they thereby cease to constitute personal data and the link to the data subject is severed.
4.7. Principle of Security: The University shall adopt the technical, human, and administrative measures necessary to protect personal information and prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access. These measures shall be consistent with the Information Security and Privacy Policy (Information Security and Privacy Policy).
4.8. Principle of Confidentiality: All persons involved in the processing of personal data who have access to non-public information are required to maintain the confidentiality of such information, even after their involvement in data processing activities has ended. They may only provide or disclose data when doing so is consistent with the performance of functions authorized by law.
4.9. Principle of Accountability: Also known as accountability, this principle requires organizations to be able to provide evidence and demonstrate to the competent authorities that they have implemented the measures necessary to comply with their personal data protection obligations.
4.10. Principle of Institutional Culture and Shared Responsibility: Personal data protection is a cross-cutting responsibility of Universidad Industrial de Santander and all persons involved in data processing. Accordingly, public servants, faculty members, students, contractors, suppliers, and other members of the university community shall understand their duties, implement appropriate security and confidentiality measures, respect the rights of data subjects, properly manage the data and documents under their responsibility, and promptly report any risk, incident, or potential breach involving personal data.
ARTICLE 5: Categorization of Purposes by Data Subject
The processing of personal data (public, private, semi-private, and sensitive) by Universidad Industrial de Santander shall have the general purpose of collecting, storing, using, circulating, and deleting information necessary for the development of academic, employment, contractual, or any other relationships linking the data subject to the University in its capacity as data controller.
Accordingly, the purposes listed below are merely illustrative and not exhaustive, since the University may process personal data for any purposes that are necessary, relevant, and consistent with the nature of its relationship with the data subject and the performance of its institutional functions:
5.1. Applicants and Prospective Students: Management of information related to academic offerings, admission processes, career guidance, financial counseling, and institutional market research.
5.2. Students Enrolled in Degree Programs or Extension Programs: Management of the academic relationship, including enrollment processes, socioeconomic profiling, issuance of identification cards, issuance of certificates, insurance policy management, use of technological platforms, as well as activities related to student welfare programs, socioeconomic support, security, and access control across university campuses.
5.3. Alumni: Monitoring of professional careers, strengthening of accreditation processes, institutional engagement, and promotion of continuing education and graduate programs.
5.4. Faculty and Administrative Staff: Management of recruitment and appointment processes, socioeconomic profiling, payroll and benefits administration, access control—including, where appropriate, the use of biometric data—performance evaluation, and professional development.
5.5. Suppliers and Contractors: Management of pre-contractual, contractual, and post-contractual processes, including verification of requirements, background checks, socioeconomic profiling, payment administration, and compliance with legal and commercial obligations.
5.6. Visitors: Management of information required to control access to the University’s campuses, sites, facilities, including virtual environments, as well as information related to the purpose of the visit.
5.7. Pensioners: Comprehensive management of the legal and administrative relationship with persons who receive a pension recognized and paid by Universidad Industrial de Santander or who acquired such status as a result of their employment relationship with the Institution. This purpose includes the processing of personal data necessary for the recognition, administration, recalculation, substitution, suspension, or termination of pension benefits, where applicable; payment of pension allowances and other benefits; compliance with legal, tax, accounting, and social security obligations; response to judicial and administrative requests; issuance of certificates; management of records and documents; and, in general, all actions related to their status as pensioners and to the fulfillment of the functions and obligations assigned to the University in this regard by applicable law.
In furtherance of the purposes of personal data processing, and as applicable to all data subjects associated with the University, the University may, among other activities related to the respective purpose:
- Share information with financial institutions with which it has agreements in force, exclusively for the purpose of offering services associated with the university community.
- Apply data analytics, data science, and artificial intelligence techniques to collected information, provided that data subjects cannot be identified, for the purpose of optimizing institutional processes, including those related to contract and supplier management.
- Transfer and transmit personal data to third parties with whom it maintains operational, contractual, or legal relationships necessary for the performance of its functions, requiring in all cases compliance with the principles and obligations governing personal data protection.
- Use technologies such as “cookies” on its websites and applications to ensure their proper operation, improve the user experience, analyze the use of its services, and provide relevant content in accordance with the settings authorized by the user.
- Capture and use images through photography or video in academic, administrative, and commercial activities, whether in person or virtual, both for institutional promotional and communication purposes and for the implementation of security measures at its facilities, while ensuring respect for the rights of data subjects in all cases.
Data generated through the University’s core functions and administrative support activities shall be reported to the official information systems of the education, planning, and government sectors, or to legally established professional councils that require such information in accordance with applicable legal provisions.
ARTICLE 6. Processing of Sensitive Data
Universidad Industrial de Santander may process sensitive personal data only when such processing is necessary for the performance of its constitutional, legal, academic, administrative, employment, disciplinary, assistance, or university welfare functions, while at all times observing the principles of lawfulness, purpose limitation, freedom, necessity, proportionality, confidentiality, and information security.
Sensitive data are understood as data that affect the privacy of the data subject or whose improper use may result in discrimination, such as data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions or social organizations, health-related data, sexual life, biometric data, or any other data defined as sensitive under applicable legislation.
The University may process sensitive data only when at least one of the following conditions is met:
- The data subject has given prior, express, and informed consent to such processing, except in cases exempted by law or where the processing is inherent to the academic, employment, contractual, or regulatory relationship with the University.
- The processing is necessary to safeguard the vital interests of the data subject and the data subject is physically or legally incapable of providing authorization. In such cases, authorization may be granted by the data subject’s legal representative or by the person providing support in accordance with the applicable legal framework.
- The processing is necessary for the recognition, exercise, or defense of rights in judicial, administrative, or disciplinary proceedings.
The processing is carried out for historical, statistical, scientific, research, academic, or archival purposes, provided that measures are adopted to anonymize or pseudonymize the data or otherwise remove the identity of the data subjects, where appropriate.
Paragraph. The University shall adopt enhanced technical, human, and administrative measures to ensure the confidentiality, privacy, and security of sensitive personal data, restricting access exclusively to personnel authorized to access such data by virtue of their duties.
ARTICLE 7: Processing of Personal Data of Children and Adolescents
Universidad Industrial de Santander shall process the personal data of children and adolescents in strict compliance with the Political Constitution, the law, and the principles of comprehensive protection of their fundamental rights.
The processing of children’s personal data shall require the prior and express authorization of their legal representatives, except when the information is public in nature or when such processing is authorized by law.
In all cases, the University shall ensure that the processing serves the best interests of children and adolescents and safeguards their fundamental rights, particularly those related to privacy, dignity, comprehensive development, and the free development of personality.
With respect to adolescents over twelve (12) years of age, the University may recognize their capacity to provide consent for the processing of information related to their academic, student, cultural, research, sports, or university welfare activities, in accordance with their level of maturity and development, without prejudice to the participation and support of their legal representatives when necessary.
Paragraph. The University shall implement clear, accessible, and age-appropriate information mechanisms to ensure that children and adolescents understand the purposes and conditions governing the processing of their personal data.
ARTICLE 8: Duration of Processing and Retention of Personal Data
Personal data processed by Universidad Industrial de Santander shall remain subject to processing for as long as necessary to fulfill the purposes for which they were collected, as well as for the duration of the corresponding academic, employment, contractual, legal, or regulatory relationship.
Once the relationship with the data subject has ended, the University may retain the information for any additional period required by applicable legislation, institutional regulations, archival standards, and provisions governing statutes of limitations and fiscal, disciplinary, contractual, or judicial liability.
The retention and deletion of personal data shall be governed by the principles of necessity, reasonableness, temporality, and proportionality. Once the purpose of the processing has ceased and there is no legal or contractual obligation to retain the data, the University shall proceed with the deletion, anonymization, or secure blocking of the information, as appropriate.
Paragraph. Personal data that form part of the University’s documentary and archival heritage may be retained for historical, scientific, statistical, or institutional memory purposes, in accordance with applicable archival and personal data protection regulations.
ARTICLE 9: Coordination with Institutional Records Management
The management, retention, consultation, transfer, final disposition, and preservation of physical, electronic, or hybrid documents containing personal data shall be carried out in coordination with the provisions of the Records Management process of Universidad Industrial de Santander, in accordance with applicable archival regulations, the Document Retention Schedules (TRD), Document Appraisal Schedules (TVD), Access Control Schedules (TCA), internal records management procedures, and applicable personal data protection guidelines.
Accordingly, every academic or administrative unit that produces, receives, manages, retains, or processes documents containing personal data shall ensure that such documents are managed in accordance with the criteria of authenticity, integrity, availability, confidentiality, traceability, preservation, and restricted access, taking into account the nature of the information, the purpose of the processing, access criteria, and institutionally established retention periods.
ARTICLE 10: Rights of the Personal Data Subject
Data subjects whose personal data are processed by Universidad Industrial de Santander shall have the following rights, in accordance with the Constitution, Law 1581 of 2012, and all other applicable regulations:
- Access, update, and rectify their personal data held by the University, particularly when such data are partial, inaccurate, incomplete, fragmented, misleading, have been processed without authorization, or are processed in violation of applicable regulations.
- Request proof of the authorization granted for the processing of their personal data, except where such authorization is not required by law.
- Be informed, upon request, of the use that the University has made of their personal data.
- Request the revocation of authorization or the deletion of their personal data by submitting a claim in accordance with the procedures established for this purpose. A request for deletion or revocation may be made, among other circumstances, when:
- The data subject considers that their personal data are not being processed in accordance with the principles, rights, duties, and obligations established by law.
- The data are no longer necessary or relevant for the purpose for which they were collected.
The period necessary for processing the personal data, based on the purpose for which they were collected, has expired.
The deletion of personal data entails the total or partial removal of information contained in the University’s databases, records, or information systems, in accordance with the request submitted by the data subject and applicable legal provisions.
Revocation of authorization and/or deletion may be requested with respect to all or part of the personal data being processed, except for information whose processing must continue pursuant to a legal or contractual obligation or under special regulations, including those established in Law 1266 of 2008 and any provisions that amend, supplement, or replace it.
Paragraph. A request for the deletion of personal data or revocation of authorization shall not apply when:
- The data subject has a legal, contractual, academic, or regulatory obligation requiring their information to remain in the University’s databases.
- Deletion of the information could hinder judicial, administrative, disciplinary, or fiscal proceedings, the investigation or prevention of unlawful conduct, or compliance with legal obligations.
- The data are necessary to protect the data subject’s legally protected interests, to carry out activities in the public interest, or to fulfill legal obligations assumed by the University or the data subject.
ARTICLE 11: Procedures for Exercising Rights: - Inquiries, Claims, and Service Channels for the Exercise of Data Subject Rights
Personal data subjects or their representatives may exercise their rights to access, update, correct, delete, and revoke authorization with respect to information processed by Universidad Industrial de Santander, in accordance with applicable legal provisions, this Manual, and the procedures adopted for the processing of personal data within the framework of the institutional Quality Management System.
Inquiries. Data subjects may, at any time, request access to personal information held in the University’s databases or records. Requests shall be submitted through the institutional channels established for this purpose.
The University shall respond to an inquiry within a maximum of ten (10) business days from the date the request is received. When it is not possible to respond within this period, the interested party shall be informed before the period expires, stating the reasons for the delay and the date on which the request will be addressed, which may not exceed five (5) business days following the expiration of the initial period.
Claims. Data subjects or their successors in interest who consider that information contained in a database should be corrected, updated, deleted, or that authorization for its processing should be revoked may submit a claim to the University..
The claim shall contain, at a minimum, identification of the data subject, a description of the facts giving rise to the request, contact information, the data to be corrected or deleted if this is the scope of the claim, and any supporting documents the claimant wishes to submit.
If the claim is incomplete, the University shall request that the interested party remedy the identified deficiencies within five (5) business days following receipt of the claim. If one (1) month elapses from the date of such request without the applicant providing the required information, the claim shall be deemed withdrawn, in accordance with Article 17 of Law 1437 of 2011. The maximum period for responding to a claim shall be fifteen (15) business days, counted from the day following the date on which the complete claim is received. When it is not possible to respond within this period, the University shall inform the interested party of the reasons for the delay and the date on which the claim will be resolved, which may not exceed twice the period initially established.
Paragraph. Official Service Channels. Universidad Industrial de Santander shall provide official institutional channels for receiving and processing inquiries, petitions, complaints, claims, and requests related to the processing of personal data. For this purpose, the University shall maintain a “Complaints, Claims, and Suggestions” link on its institutional website, as well as designated institutional email addresses for handling requests related to the protection and processing of personal data.
• ARTICLE 12: Institutional Personal Data Protection System
Universidad Industrial de Santander shall incorporate personal data protection as a subprocess of the institutional Quality Management System, aimed at ensuring compliance with constitutional, legal, and regulatory provisions governing the processing and security of information.
This subprocess shall have a coordinating and preventive role and shall encompass planning, monitoring, control, continuous improvement, risk management, technical and legal support, and institutional strengthening activities related to the processing of personal data.
Paragraph. All academic and administrative units that, in the performance of their functions, collect, store, manage, safeguard, circulate, or use personal data shall implement the institutional guidelines, protocols, and measures established within the institutional Quality Management System.
• ARTICLE 13: Personal Data Protection Officer
Universidad Industrial de Santander shall have a Personal Data Protection Officer responsible for coordinating, guiding, supervising, and verifying compliance with institutional policies, procedures, and measures related to the processing of personal data.
The Personal Data Protection Officer shall serve as the leader of the institutional personal data protection subprocess and shall perform their duties in coordination with the University’s academic, administrative, and technology units.
ARTICLE 14: Functional Direction and Specialized Support
The role of Personal Data Protection Officer shall be assumed by the person holding the position of Legal Advisor to the Rector’s Office of Universidad Industrial de Santander, who shall be responsible for institutionally leading the legal and regulatory component associated with personal data protection.
For the proper performance of its functions, the institutional personal data protection subprocess may receive support from external legal counsel for the analysis of regulatory changes, regulatory updates, the issuance of specialized legal opinions, and the strengthening of institutional capacities.
Paragraph. The participation of external advisors shall be technical and specialized in nature and shall not relieve University units of their respective responsibilities arising from the processing of personal data under their administration.
• ARTICLE 15: Functions of the Personal Data Protection Officer
Without prejudice to any other functions assigned by the Rector’s Office or by institutional regulations, the Personal Data Protection Officer shall have the following functions:
- Promote and strengthen the institutional culture of personal data protection through training and awareness-raising activities for public servants, faculty members, students, contractors, and other members of the university community.
- Coordinate the monitoring of and compliance with institutional personal data protection provisions.
- Advise the Rector’s Office and University units on the implementation of measures, tools, and controls related to personal data protection.
- Provide legal guidance and support regarding the processing of personal data.
- Coordinate prevention, risk management, and continuous improvement actions related to the processing of personal information.
- Support the handling of inquiries, claims, requests, and proceedings related to personal data protection.
- Coordinate actions with the units responsible for information technology, records management, institutional statistics, internal control, and other areas involved in the processing of personal data.
- Report security incidents and data subject claims within the time limits established by law.
ARTICLE 16: Responsibilities of University Units and Data Processors
The academic and administrative units of Universidad Industrial de Santander and, in general, all public servants and collaborators who, by virtue of their duties and responsibilities, manage information systems, technology platforms, databases, physical or digital records, or any other mechanism containing information related to this Manual shall act as data processors, as applicable. Accordingly, they shall:
- Ensure the confidentiality, integrity, availability, and security of the information under their administration.
- Implement the technical, administrative, and organizational measures established by the University for the protection of personal data and information security.
- Comply with the guidelines issued by the Personal Data Protection Officer.
- Report security incidents, risks, or potential breaches involving personal data.
- Adopt mechanisms for the ongoing control and updating of academic, administrative, financial, employment, and other information processed in the performance of institutional functions.
- Ensure that personal data are processed solely for legitimate and authorized purposes consistent with institutional functions.
• ARTICLE 17: National Database Registry
Universidad Industrial de Santander shall register, update, and manage the information corresponding to the National Database Registry (RNBD) before the Superintendence of Industry and Commerce or the authority acting in its place, in accordance with applicable regulations.
For the purpose of complying with this obligation, the Institutional Committee for the National Database Registry shall operate and shall be composed of:
- The Head of the University’s Information and Statistical Analysis Unit, who shall coordinate the Committee.
- The Head of the Information and Communications Technology Division.
- The Director of Certification and Records Management.
- The University’s Legal Advisor, or the person acting in their place.The directors or heads of the units responsible for the administration and custody of databases that must be reported or updated in the National Database Registry.
The Director of the Internal Control and Management Evaluation Office shall be a permanent invitee to Committee meetings, with the right to participate in discussions but without voting rights, in the exercise of their duties related to the evaluation and monitoring of the Internal Control System.
The Committee, with the participation of the directors or heads responsible for the administration and custody of the databases subject to registration or updating, shall review, validate, and approve the information to be registered, updated, or modified in the National Database Registry, in accordance with the frequency, deadlines, and requirements established by applicable regulations and by the Superintendence of Industry and Commerce or the authority acting in its place.
Likewise, the Committee shall review and analyze security incidents involving personal data or breaches of security protocols in the management of information subject to processing, in order to determine whether such incidents should be reported to the competent authority, where applicable, and to recommend the adoption of the necessary preventive, corrective, and improvement measures to mitigate their effects, address their causes, and prevent recurrence.
• ARTICLE 18: Updating the Institutional Quality Management System for Personal Data Protection
During the second half of 2026, Universidad Industrial de Santander shall undertake the process of updating and harmonizing the institutional Quality Management System in order to incorporate the personal data protection subprocess as an integral part of the Legal Support Process.
For this purpose, the procedures, protocols, forms, and other documents associated with the processing and protection of personal data at the University shall be developed, reviewed, updated, and implemented.
Paragraph 1. This process shall be carried out under the coordination of the institutional Quality Management System, with the technical and functional support of the Legal Advisory Office of the Rector’s Office, Planning – UIAES, the Certification and Records Management Office, the relevant Academic-Administrative Units, and any other University units that, by virtue of their functions, are involved in the processing of personal data.
Paragraph 2. All academic and administrative units shall participate in the institutional updating process by providing the required information and adopting the measures necessary to implement the established personal data protection guidelines.
• ARTICLE 19: Effective Date and Regulatory Updates
This policy comprehensively updates the provisions contained in Resolution No. 1227 of 2013 and any other internal regulations that are contrary to it.