Colombia data privacy lawyer
Law Offices of SRIS, P.C. is a US law firm founded in 1997 that assists Colombian businesses, entrepreneurs, and individuals with US data privacy and cybersecurity compliance. Mr. Sris, the firm’s founder and managing attorney, is admitted to practice in Virginia, Maryland, the District of Columbia, New Jersey, and New York. For Colombia-law matters, the firm works with Eric Duport Jaramillo, Of Counsel, admitted to practice law in Colombian bar and not admitted in any US state bar; that role is limited to Colombia-law matters in collaboration with the US-admitted attorneys of the firm. All US-law aspects are handled by Mr. Sris and the US-admitted attorneys of the firm. This page provides general information and is not legal advice; no attorney-client relationship is formed by viewing it or contacting the firm. To discuss a cross-border data privacy matter, call (888) 437-7747.
US data privacy laws that affect Colombian businesses and individuals
Colombian companies that collect, store, or process personal data of US residents must navigate a patchwork of federal and state privacy statutes. The most far-reaching is the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, which grants California residents rights to access, delete, and opt out of the sale of their personal information. Even a Colombian e-commerce site with California visitors may be subject to the CCPA if it meets certain revenue or data-volume thresholds.
Other US privacy frameworks that frequently arise in cross-border contexts include the Health Insurance Portability and Accountability Act (HIPAA), which protects health information held by covered entities and business associates; the Gramm-Leach-Bliley Act (GLBA), governing financial institutions’ handling of non-public personal information; and the Federal Trade Commission Act Section 5, which prohibits unfair or deceptive acts or practices and serves as the primary federal enforcement tool for data security failures. Virginia’s Consumer Data Protection Act (VCDPA) also applies to businesses that target Virginia residents, adding another layer of compliance for Colombian firms with a US customer base.
How Law Offices of SRIS, P.C. assists with cross-border data privacy matters
The firm provides US-side counsel on data privacy compliance, breach response, and regulatory investigations, while coordinating with its Colombia Of Counsel on any Colombian-law dimensions. A typical engagement begins with a review of the client’s data flows to determine which US privacy laws may apply. The firm then advises on drafting privacy notices, implementing data-subject request procedures, and negotiating data-processing agreements that satisfy US legal requirements.
When a Colombian company suffers a data breach affecting US residents, the firm guides the client through the multi-state breach-notification obligations, which can involve notifying affected individuals, state attorneys general, and federal regulators. The firm also represents clients in FTC or state attorney general inquiries and defends against private class-action litigation. Throughout the process, the firm’s Colombia Of Counsel, Eric Duport Jaramillo, is available to address any Colombian-law issues that intersect with the US matter, ensuring that the client receives coordinated cross-border advice without any attorney practicing outside their licensed jurisdiction.
About Mr. Sris and the firm’s cross-border practice
Mr. Sris, Owner and Founder of Law Offices of SRIS, P.C., has built a practice that serves international clients with US legal needs. Admitted in Virginia, Maryland, the District of Columbia, New Jersey, and New York, he has handled data privacy matters for businesses and individuals across multiple industries. The firm’s cross-border practice is supported by a network of Of Counsel attorneys, including Eric Duport Jaramillo for Colombia-law matters, allowing the firm to offer integrated US-Colombia counsel while maintaining strict jurisdictional separation.
Law Offices of SRIS, P.C. was founded in 1997 and maintains its principal location in Virginia, by appointment only, as well as a location in Pereira, Colombia. The firm’s approach to data privacy is grounded in a thorough understanding of the US regulatory landscape and a practical focus on helping clients achieve compliance without disrupting their business operations.
Frequently asked questions
Does a Colombian company need a US data privacy lawyer?
A Colombian company that collects personal data from US residents may need US data privacy counsel to comply with state and federal laws. Even without a physical presence in the United States, a business can be subject to the CCPA, VCDPA, or other state privacy statutes if it meets the applicable thresholds. A US-licensed attorney can help determine which laws apply, draft compliant policies, and respond to regulatory inquiries. For a consultation, call (888) 437-7747.
What is the difference between US and Colombian data privacy law?
US data privacy law is sector-specific and enforced by multiple agencies, while Colombia’s data protection framework is based on a comprehensive statute, Ley 1581 of 2012, and overseen by the Superintendencia de Industria y Comercio. The US lacks a single omnibus federal privacy law; instead, rules vary by industry (HIPAA for health, GLBA for finance) and by state (CCPA, VCDPA). Colombian law, by contrast, establishes a general data protection regime with rights similar to the GDPR. Cross-border matters often require analysis under both systems, which the firm handles through its US-admitted attorneys and its Colombia Of Counsel.
How does the firm handle a data breach that affects both US and Colombian residents?
The firm coordinates the US-side breach response while its Colombia Of Counsel addresses Colombian notification requirements. In the US, the firm identifies the states whose residents were affected, determines the applicable breach-notification timelines, and prepares the required notices to individuals and regulators. Simultaneously, the Colombia Of Counsel advises on obligations under Colombian law, such as notifying the Superintendencia de Industria y Comercio. The two sides work together to ensure a consistent, timely response without any attorney practicing outside their licensed jurisdiction.
Can the firm help a Colombian citizen whose personal data was mishandled by a US company?
Yes, the firm can represent a Colombian citizen in a US data privacy matter, provided the claim arises under US law. The firm’s US-admitted attorneys can evaluate whether the US company violated the CCPA, HIPAA, or other applicable statutes, and can pursue remedies such as statutory damages or injunctive relief. If the matter also involves Colombian law—for example, if the data was transferred from Colombia in violation of Ley 1581—the firm’s Colombia Of Counsel can advise on that aspect. To discuss a potential claim, call (888) 437-7747.
What should a Colombian business do before launching a US-facing website?
A Colombian business should conduct a data-mapping exercise and consult US privacy counsel to identify applicable legal requirements. The firm helps clients inventory the personal data they will collect, determine which US privacy laws may apply based on the nature of the data and the states where users reside, and draft a privacy policy that meets US standards. Early compliance planning can reduce the risk of regulatory enforcement and consumer litigation. For guidance, contact Law Offices of SRIS, P.C. at (888) 437-7747.