The SIC issued a mandatory order to WhatsApp LLC to implement measures in accordance with the Colombian standard on Habeas Data and due treatment of personal data.

The decision was made through Resolution 29826 of May 2021, after determining that WhatsApp LLC's Information Processing Policy fails to comply with 57.89% of the requirements of Colombian regulations.

Additionally, it was established that said company also fails to comply with 75% of the requirements established in Article 12 of the Statutory Law 1581 of 2012.

The SIC was able to establish that this company collects and treats personal data of at least thirty-nine (39) million monthly active users in Colombia and that it uses "cookies" to collect or treat personal data in the national territory. Thus, it determined that Law 1581 of 2012 is applicable to WhatsApp LLC, since this company collects or captures personal data through a tool that is installed on mobile devices and computers located in Colombia.

Specifically, the SIC ordered, among others:

• To create an Information Processing Policy that meets all the requirements demanded by Colombian regulations. Said ITP must be informed to the Data Owners domiciled or resident in the Colombian territory.
• Implement an appropriate mechanism or procedure so that, at the time of requesting the Authorization of the individuals, they are informed in Spanish, in a clear, simple and express manner all that is required by Article 12 of the Statutory Law 1581 of 2012.

• Register its Databases in the National Registry of Databases (RNBD), administered by the Superintendence of Industry and Commerce, with respect to the Data collected or processed in the territory of the Republic of Colombia on persons resident or domiciled in this country.

Failure to comply with these orders entails sanctioning administrative investigations that may result in fines of up approximately USD 478,172 or the suspension of WhatsApp LLC's activities in Colombia.