Regulations › Rest of world › Colombia
Law 1581
Statutory Law 1581 of 2012 on General Provisions for the Protection of Personal Data
WhenIn effect since 18 October 2012
Who enforces itSuperintendencia de Industria y Comercio (SIC), Delegatura para la Protección de Datos Personales
Who it applies toProcessing of personal data in Colombia, and by foreign controllers where Colombian law applies.
Tell the regulatorReport security incidents to SIC through the RNBD within 15 business days of detection
DPO requiredEvery controller and processor must designate a person or area to assume the data protection f…
RegistrationCompanies and non-profits above an asset threshold (and public entities) must register databas…
Transfers abroadTransfers to countries without adequate protection are prohibited unless an exception applies…
Request deadlineQueries within 10 business days (plus 5)
Maximum fineUp to 2,000 monthly minimum wages (roughly USD 0.7m), plus suspension or closure of operations
62%
of Colombia's 21 requirements are already met by European Union (GDPR). Here is what Law 1581 adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
Law 1581 adds3 Prior, express and informed authorization is required, with narrow exceptions (public authority requests, public data, medical emergencies, civil registry). No legitimate interests.
Arts. 9, 10 · source ↗
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
Law 1581 adds3 Every controller and processor must designate a person or area to assume the data protection function and handle requests.
Decree 1377 art. 23 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
Law 1581 adds3 Authorization may be written, oral or by unequivocal conduct, never silence; controllers must keep proof of it.
Art. 17(b); Decree 1377 arts. 7, 8 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
Law 1581 adds3 Processing data of all minors under 18 is prohibited except public data, or with legal representative authorization respecting the child's best interests.
Art. 7; Decree 1377 art. 12 · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
Law 1581 adds3 Queries within 10 business days (plus 5); claims for correction or deletion within 15 business days (plus 8).
Arts. 14, 15 · source ↗
MarketingPeople's rightsGap
GDPR2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
Law 1581 adds3 Any marketing use needs prior, express, informed authorization for that purpose; holders may revoke at any time.
Arts. 8(e), 9 · source ↗
RegistrationGovernanceGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
Law 1581 adds1 Companies and non-profits above an asset threshold (and public entities) must register databases in the SIC's National Database Registry (RNBD) and update annually.
Art. 25; Decree 090/2018 · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
Law 1581 adds2 Penal Code offense of personal data violation: 48 to 96 months' imprisonment and fines of 100 to 1,000 minimum wages.
Penal Code art. 269F (Law 1273 of 2009) · source ↗
Already covered by GDPR: Reach abroad, Sensitive data, Rights, DPO qualifications, DPIA, Records, Retention, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Private action.
A gap means Law 1581 is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws