Regulations › Rest of world › Colombia
Law 1581
Statutory Law 1581 of 2012 on General Provisions for the Protection of Personal Data
WhenIn effect since 18 October 2012
Who enforces itSuperintendencia de Industria y Comercio (SIC), Delegatura para la Protección de Datos Personales
Who it applies toProcessing of personal data in Colombia, and by foreign controllers where Colombian law applies.
Tell the regulatorReport security incidents to SIC through the RNBD within 15 business days of detection
DPO requiredEvery controller and processor must designate a person or area to assume the data protection f…
RegistrationCompanies and non-profits above an asset threshold (and public entities) must register databas…
Transfers abroadTransfers to countries without adequate protection are prohibited unless an exception applies…
Request deadlineQueries within 10 business days (plus 5)
Maximum fineUp to 2,000 monthly minimum wages (roughly USD 0.7m), plus suspension or closure of operations
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
1
Applies to processing in Colombia and to foreign controllers or processors when Colombian law applies under international norms or treaties.Art. 2 · source ↗
SIC has also asserted jurisdiction over foreign platforms collecting data in Colombia (not reviewed).
Lawful basis
3
Prior, express and informed authorization is required, with narrow exceptions (public authority requests, public data, medical emergencies, civil registry). No legitimate interests.Arts. 9, 10 · source ↗
Consent
3
Authorization may be written, oral or by unequivocal conduct, never silence; controllers must keep proof of it.Art. 17(b); Decree 1377 arts. 7, 8 · source ↗
Scored 3 because proof of each authorization must be retained.
Sensitive data
2
Processing sensitive data is prohibited except with explicit authorization or listed exceptions; no activity may be conditioned on providing it.Arts. 5, 6; Decree 1377 art. 6 · source ↗
Children
3
Processing data of all minors under 18 is prohibited except public data, or with legal representative authorization respecting the child's best interests.Art. 7; Decree 1377 art. 12 · source ↗
People's rights
Rights
2
Know, update and correct data; proof of authorization; information on use; complain to SIC; revoke authorization or request deletion.Art. 8 · source ↗
No portability or automated-decision right.
Request deadline
3
Queries within 10 business days (plus 5); claims for correction or deletion within 15 business days (plus 8).Arts. 14, 15 · source ↗
Marketing
3
Any marketing use needs prior, express, informed authorization for that purpose; holders may revoke at any time.Arts. 8(e), 9 · source ↗
Governance
DPO required
3
Every controller and processor must designate a person or area to assume the data protection function and handle requests.Decree 1377 art. 23 · source ↗
DPO qualifications
0
No qualifications set for the designated person or area.Decree 1377 art. 23 · source ↗
Registration
1
Companies and non-profits above an asset threshold (and public entities) must register databases in the SIC's National Database Registry (RNBD) and update annually.Art. 25; Decree 090/2018 · secondary source · source ↗
Threshold is 100,000 UVT in total assets per Decree 090/2018; source read confirms only the 610,000 UVT first-phase threshold.
DPIA
0
No DPIA requirement in Law 1581 or Decree 1377.Not addressed · source ↗
SIC accountability guidance reportedly recommends impact assessments (not reviewed).
Records
1
No general records duty; RNBD filings and documented processing, retention and deletion procedures act as a limited inventory.Art. 25; Decree 1377 art. 11 · source ↗
Retention
1
Process data only as long as reasonable and necessary for the purpose, then delete unless law or contract requires retention.Decree 1377 art. 11 · source ↗
Breaches
Tell the regulator
2
Report security incidents to SIC through the RNBD within 15 business days of detection.Arts. 17(n), 18(k); SIC Circular Externa 003/2018 · secondary source · source ↗
Statute sets the duty; the 15-day deadline comes from SIC rules.
Transfers
Transfers abroad
2
Transfers to countries without adequate protection are prohibited unless an exception applies (explicit consent, contract, treaty) or SIC issues a declaration of conformity.Art. 26; Decree 1377 arts. 24-25 · source ↗
Transmissions to processors need a contract (Decree 1377 art. 25).
Enforcement
Maximum fine
2
Up to 2,000 monthly minimum wages (roughly USD 0.7m), plus suspension or closure of operations.Art. 23 · source ↗
Criminal liability
2
Penal Code offense of personal data violation: 48 to 96 months' imprisonment and fines of 100 to 1,000 minimum wages.Penal Code art. 269F (Law 1273 of 2009) · source ↗
Private action
2
Data subjects complain to SIC after exhausting the controller process; damages are claimed under general civil liability.Art. 16 · source ↗
Law 1581 has no specific damages clause; civil liability rests on general law (not reviewed).
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws