On November 3 of 2016, a user filed a complaint against the mobile platform RAPPI for his information to be deleted from their databases, as he didn’t want to receive any more text messages or emails from the company. However, he continued to receive publicity from the company, so he decided to file a formal complaint in the Superintendencia de Industria y Comercio (SIC). Thus, in March 26 0f 2018, by the Resolution No. 21206, the SIC initiated an administrative investigation against the company RAPPI S.A.S, as a Personal Data Treatment Controller.

In this investigation several flaws where determined on the way RAPPI was not only treating, but also recollecting information from users (personal data Holders). According to the company, when each user downloaded the app, it had to accept the Terms and Conditions, which allowed the company to record the moment in which each individual begins to use its services.

However, as the resolution mentions, “the Terms and Conditions should not be confused with the prior, clear and informed authorization required by the law. Even though they are not exclusive, the former does not necessarily meet the legal requirements of the authorization […]”. This way, it was concluded that RAPPI was not capable of proving that it had the needed authorizations from all of its users, and also failed to demonstrate that it had effective channels that would allow its users to enforce their rights as personal data Holders.

Finally, by Resolution No. 9800 of 2019, the SIC imposed to RAPPI a fine of approximately 360 smlmv ($298,000.000), and gave the company a period of three months to adopt free and effective mechanisms that allow users an easy access, so they can ask for their personal information to be eliminated from the data bases.


Colombian companies that collect information must be sure they inform and obtain the required authorization from personal data Holders. Especially when this is done through applications or websites. It is not enough to indicate an acceptance of Terms and Conditions for the use of certain web page, as the specific Privacy Policy should be informed, and the authorization obtained..