Modelo para la implementación de la técnica de Tokenización como mecanismo de protección de datos personales

Abstract

This monographic document establishes the guide to plan and implement the tokenization system, as a mechanism of protection of personal data, described in law 1581 of 2012. We begin with the analysis of the current situation, to identify which are the applications that administer personal data, where and how they are stored, level of impact with the implementation of the model. Once the current situation has been established, the analysis begins to ensure information, separation of responsibility to ensure it and minimize the impact on the normal development of the organization's activities, without affecting the business model and minimizing the possibility of theft of information. For the implementation of the tokenization principle, the model implemented in the protection of credit card transactions, described in PCI-DSS, was taken as a basis and, according to this, we made the necessary components and their characteristics for an effective implementation of the model within any organization, based on current legislation and algorithms most used in the protection of information. In the last part of the work is described the process of implementing a pilot test performed to assess the impact, level of difficulty and efficiency of the model applied to a financial organization that has the obligation to comply with the data protection law personal and seeks to apply the most efficient method of lower financial cost and low operational impact in its implementation.