Colombia

Regulator And AuthorityGreen

SIC is institutionally housed within the Ministry of Industry, Trade and Tourism yet Law 1581 vests it with independent sanctioning and inspection powers.

Claims (1):

• Although the SIC is integrated within the structure of the Ministry of Industry, Trade and Tourism, Law 1581 provides it with the power to impose sanctions and other powers necessary for compliance with the law's objectives.

Act And InstrumentsGreen

Two parallel statutes (1266/2008 and 1581/2012) form a common legal regime for personal data protection.

Claims (1):

• Colombia has two data protection statutes — Law 1266 of 2008 (credit reporting) and Law 1581 of 2012 (general personal data protection) — which together constitute a common legal regime.

Material ScopeGreen

The constitutional habeas data action operates as a directly enforceable fundamental right independent of statutory processes.

Claims (1):

• The Colombian Constitution provides a special judicial remedy for data protection known as 'habeas data,' a fundamental and directly applicable right before any judge.

Territorial ScopeAmber

Historical reporting (2018) indicated a draft bill to extend SIC's investigative jurisdiction over foreign-headquartered controllers; current legislative status of that specific proposal could not be confirmed in this research pass.

Claims (1):

• As of 2018 reporting, a draft bill existed to give the SIC power to investigate companies headquartered outside Colombia (e.g., Facebook, Google), though current passage status is unconfirmed.

Regulator Registration And FilingGreen

Controllers/processors above defined asset thresholds must register databases in the National Database Registry (RNBD); SMEs and natural persons are exempted since Decree 90/2018.

Claims (1):

• Natural persons and SMEs are exempt from RNBD registration, while public legal entities and companies/non-profits with assets above 100,000 UVT must register their databases within established deadlines.

Lawful BasesGreen

Article 17 of Law 1581 requires controllers to adopt an internal manual of policies and procedures as the operative accountability/legal-basis documentation mechanism.

Claims (1):

• Article 17 of Law 1581 lists data controller responsibilities including the requirement to adopt an internal manual of policies and procedures to ensure proper compliance.

Consent ThresholdsGreen

Authorization from the data subject is required as the general rule, except for 'public data' obtained from public registries, official bulletins or judicial decisions.

Claims (1):

• Public data — data that is not sensitive, private, or semiprivate, such as data from public registries, official bulletins or judicial decisions — does not require data-subject authorization under the Data Protection Law.

Special CategoriesGreen

Decree 1377 introduced biometric data into the sensitive-data definition, and children's data is treated jointly with sensitive data as a special category requiring the child's superior interest to be considered.

Claims (2):

• Decree 1377 introduced a new definition of sensitive data that includes biometric data.
• Children's personal data is treated together with sensitive data as a special category, with a specific provision that the superior interest of the child be considered when such data is collected.

Pseudonymisation And AnonymisationRed

No dedicated statutory pseudonymisation/anonymisation safe-harbour definition was located in the sources reviewed.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , L, a, w, , 1, 5, 8, 1, , p, s, e, u, d, o, n, y, m, i, s, a, t, i, o, n, , a, n, o, n, y, m, i, s, a, t, i, o, n, , d, e, f, i, n, i, t, i, o, n, , S, I, C, , g, u, i, d, a, n, c, e.

Access RightGreen

Law 1581 provides for access rights for data subjects.

Claims (1):

• Law 1581 contains provisions relating to the rights of data subjects, such as access, rectification, update and deletion, and the corresponding obligations of controllers and processors.

Rectification And ErasureGreen

Rectification, update and deletion rights are provided alongside access.

Claims (1):

• Law 1581 contains provisions relating to the rights of data subjects, such as access, rectification, update and deletion, and the corresponding obligations of controllers and processors.

Restriction And ObjectionRed

No dedicated restriction-of-processing or objection right distinct from rectification/erasure was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , L, a, w, , 1, 5, 8, 1, , r, i, g, h, t, , t, o, , o, b, j, e, c, t, , r, e, s, t, r, i, c, t, i, o, n, , o, f, , p, r, o, c, e, s, s, i, n, g.

Data PortabilityRed

No express statutory data-portability right was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , L, a, w, , 1, 5, 8, 1, , d, a, t, a, , p, o, r, t, a, b, i, l, i, t, y, , r, i, g, h, t.

Deadlines And Response WindowsAmber

Decree 1377 Article 27 requires controllers to adopt a process for addressing and responding to data-subject queries, requests and claims, though a specific statutory day-count deadline was not confirmed in sources reviewed.

Claims (1):

• Article 27 of Decree 1377/2013 requires the adoption of a process for addressing and responding to queries, requests and claims by data subjects regarding any aspect of treatment.

Accountability And DpiaGreen

Compliance must be proportionate to controller size/nature, data sensitivity, processing type and risk to data subjects (Decree 1377 Art 26).

Claims (1):

• At the SIC's request, data controllers must prove appropriate and effective compliance proportionate to (1) legal nature/size of the controller, (2) nature of the data, (3) type of processing, and (4) potential risks to data subjects.

Dpo RequirementsAmber

No named 'Data Protection Officer' title is mandated; instead a responsible person or group must be designated.

Claims (1):

• Decree 1377 requires a person or group within each controller/processor to be in charge of the data-protection compliance program, without mandating a formally titled Data Protection Officer.

Ropa RequirementsGreen

RNBD registration operates as the functional equivalent of a records-of-processing obligation for qualifying entities.

Claims (1):

• Natural persons and SMEs are exempt from RNBD registration, while public legal entities and companies/non-profits with assets above 100,000 UVT must register their databases within established deadlines.

Joint Controller ArrangementsRed

No specific joint-controller allocation-of-liability framework distinct from general controller/processor duties was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , L, a, w, , 1, 5, 8, 1, , j, o, i, n, t, , c, o, n, t, r, o, l, l, e, r, , l, i, a, b, i, l, i, t, y, , f, r, a, m, e, w, o, r, k.

Security MeasuresGreen

SIC has ordered comprehensive technical/organisational security programs (e.g., Uber order) grounded in the Law 1581 responsibility principle.

Claims (2):

• The SIC ordered Uber to develop, implement and maintain a comprehensive security program addressing risks of unauthorized access and protecting confidentiality/integrity of personal data, with independent third-party audits for five years.
• Law 1581 makes companies responsible for users' personal data in their custody and requires implementation of policies and practices giving effect to Colombian data-protection principles.

Breach NotificationGreen

Security incidents must be reported to the SIC's National Database Registry (RNBD) within 15 working days of detection, with no risk-based reporting threshold.

Claims (2):

• Security incidents must be reported to the SIC's National Database Registry within 15 working days from the moment they are detected and brought to the attention of the responsible person or area.
• Because the general personal-data regime makes no distinction based on impact, the RNBD reporting procedure must be activated for all security incidents in personal data processing, regardless of severity.

Retention And DisposalGreen

Data must be retained only for the purpose of collection and erased thereafter absent a legal or contractual retention duty.

Claims (1):

• Personal data should be preserved according to the purpose of its collection and later erased unless a legal or contractual duty to preserve it exists.

Transfer MechanismsGreen

Four mechanisms exist: SIC adequacy decision, statutory exception under Art 26(2), an authority statement on a specific transfer, or binding corporate rules.

Claims (1):

• Under Colombia's framework, cross-border personal data transfers require either an SIC adequacy decision, a statutory exception under Article 26(2) of Law 1581, an SIC statement on a specific transfer operation, or the use of binding corporate rules.

Adequacy ReceivedRed

Colombia has not received an EU Commission adequacy decision; EU internal materials describe the Colombia adequacy process as stalled despite Colombia's expressed interest.

Claims (1):

• EU internal documentation notes that the adequacy decision process for Colombia (along with Mexico) has stalled, notwithstanding Colombia's stated interest in the EU adequacy process.

Adequacy GrantedGreen

The SIC has declared adequacy standing under Law 1581 to Australia, Costa Rica, the United States, Mexico, Peru, Serbia and South Korea.

Claims (1):

• The SIC has declared adequacy standing under Law 1581 to third countries including Australia, Costa Rica, the United States, Mexico, Peru, Serbia and South Korea.

Sccs And BcrsGreen

Circular Externa 003/2025 (effective 19 Dec 2025) introduces voluntary Model Contractual Clauses for international transfers/transmissions; once adopted, compliance with the clauses becomes mandatory and enforceable by the SIC.

Claims (2):

• On 19 December 2025 the SIC issued Circular Externa No. 003 of 2025, introducing Model Contractual Clauses for international transfers and transmissions of personal data with detailed instructions for use.
• Adoption of the Circular 003/2025 Model Contractual Clauses is facultative, but once a controller/processor adopts them, compliance with their obligations becomes binding and enforceable by the SIC as an instruction under Law 1581.

Transfer Impact AssessmentAmber

A 2017 draft regulation proposed an accountability-based risk assessment requiring exporters to evaluate importer safeguards; confirmation of its final enactment status was not obtained in this pass.

Claims (1):

• A draft regulation proposed that, under the accountability principle, exporters demonstrate the data importer has adopted breach and security policies as a condition for recognizing a transfer's adequacy.

Data LocalisationRed

No general data-localisation mandate was identified in the sources reviewed.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , d, a, t, a, , l, o, c, a, l, i, s, a, t, i, o, n, , m, a, n, d, a, t, e, , p, e, r, s, o, n, a, l, , d, a, t, a, , S, I, C.

Financial Sector OverlayGreen

Law 1266/2008 governs financial, credit, commercial and services-related personal data (habeas data financiero), enforced separately from Law 1581.

Claims (1):

• The SIC fined Comfamiliar for publishing a negative credit report without prior communication to the information owner, violating Articles 8(10) and 12 of Statutory Law 1266 of 2008.

Credit And ScoringGreen

SIC enforcement confirms obligations to notify individuals before generating negative credit reports.

Claims (1):

• The SIC upheld a fine against Refinancia for publishing a negative credit report without the necessary authorization of the information owner, in violation of Article 8(1) and 8(5) of Law 1266 of 2008.

Health Sector OverlayRed

No health-sector-specific data protection overlay was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , h, e, a, l, t, h, , s, e, c, t, o, r, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , o, v, e, r, l, a, y, , H, I, P, A, A, -, e, q, u, i, v, a, l, e, n, t.

Telecoms And EprivacyRed

No telecoms/ePrivacy-specific cookie or communications-data overlay was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , t, e, l, e, c, o, m, s, , e, p, r, i, v, a, c, y, , c, o, o, k, i, e, s, , c, o, m, m, u, n, i, c, a, t, i, o, n, s, , d, a, t, a, , l, a, w.

Employment DataRed

No employment-specific data protection code was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , e, m, p, l, o, y, m, e, n, t, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , c, o, d, e, , S, I, C, , g, u, i, d, a, n, c, e.

EducationRed

No education-sector-specific data protection rules were identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , e, d, u, c, a, t, i, o, n, , s, e, c, t, o, r, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , r, u, l, e, s.

InsuranceRed

No insurance-sector-specific data protection rules were identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , i, n, s, u, r, a, n, c, e, , s, e, c, t, o, r, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , r, u, l, e, s, , S, I, C.

Direct MarketingGreen

SIC's highest fine to date (Comcel) addressed unauthorized data collection during a marketing campaign for lack of informed consent.

Claims (1):

• The SIC imposed its highest fine to date (COP 1,306,289,600) on Comcel S.A. for failing to obtain informed consent from customers during the 'Friends who reward you' marketing campaign, violating Law 1581 of 2012.

Cookies And TrackersRed

No dedicated cookie/tracker consent regime was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , c, o, o, k, i, e, , c, o, n, s, e, n, t, , l, a, w, , S, I, C, , e, P, r, i, v, a, c, y, , e, q, u, i, v, a, l, e, n, t.

Dark PatternsRed

No dark-pattern-specific prohibition was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , d, a, r, k, , p, a, t, t, e, r, n, s, , p, r, o, h, i, b, i, t, i, o, n, , c, o, n, s, u, m, e, r, , d, a, t, a, , l, a, w.

Opt Out SignalsRed

No Global Privacy Control/DAA-equivalent opt-out-signal framework was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , o, p, t, -, o, u, t, , s, i, g, n, a, l, , G, l, o, b, a, l, , P, r, i, v, a, c, y, , C, o, n, t, r, o, l, , S, I, C.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rules were identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , d, a, t, a, , c, l, e, a, n, , r, o, o, m, , r, u, l, e, s, , S, I, C.

Cross Context AdvertisingRed

No CPRA-style 'sale'/'share' cross-context advertising regime was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , c, r, o, s, s, -, c, o, n, t, e, x, t, , a, d, v, e, r, t, i, s, i, n, g, , s, a, l, e, , s, h, a, r, e, , d, a, t, a, , l, a, w.

Biometric RegimeGreen

Biometric data is classified as sensitive personal data under Decree 1377.

Claims (1):

• Decree 1377 introduced a new definition of sensitive data that includes biometric data.

Ai Risk AssessmentsAmber

An AI Bill submitted to Congress in May 2025 proposes a comprehensive ethical AI governance framework with extraterritorial application; it remains a proposal, not yet enacted.

Claims (2):

• On 7 May 2025, Colombia's Ministry of Science, Technology and Innovation submitted an Artificial Intelligence Bill to Congress aiming to establish a comprehensive legal framework for the ethical development, use and governance of AI systems.
• The AI Bill would apply extraterritorially to entities located abroad whose AI systems are used within Colombia.

Profiling RestrictionsRed

No dedicated statutory profiling-restriction provision was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , p, r, o, f, i, l, i, n, g, , r, e, s, t, r, i, c, t, i, o, n, s, , A, r, t, i, c, l, e, , 2, 2, , G, D, P, R, , e, q, u, i, v, a, l, e, n, t.

Automated Decision Making TransparencyRed

No specific ADM transparency/explanation right was identified distinct from the pending AI Bill.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , a, u, t, o, m, a, t, e, d, , d, e, c, i, s, i, o, n, -, m, a, k, i, n, g, , t, r, a, n, s, p, a, r, e, n, c, y, , r, i, g, h, t.

Genetic DataRed

No genetic-data-specific regime distinct from general sensitive-data rules was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , g, e, n, e, t, i, c, , d, a, t, a, , r, e, g, i, m, e, , S, I, C.

State Surveillance CarveoutsRed

No detailed state-surveillance carve-out framework beyond the general public-authority access constraints was identified in this pass.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , s, t, a, t, e, , s, u, r, v, e, i, l, l, a, n, c, e, , n, a, t, i, o, n, a, l, , s, e, c, u, r, i, t, y, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , c, a, r, v, e, -, o, u, t.

Parental ConsentAmber

Children's data is treated as a special category alongside sensitive data, with the child's superior interest to be considered upon collection.

Claims (1):

• Under Decree 1377, personal data from children is considered together with sensitive data as a special category, and a specific provision requires the superior interest of the child to be taken into account when such data is collected.

Minor Profiling BansRed

No explicit minor-specific profiling ban was identified beyond the general superior-interest principle.

Claims (1):

• Under Decree 1377, personal data from children is considered together with sensitive data as a special category, and a specific provision requires the superior interest of the child to be taken into account when such data is collected.

Age VerificationRed

No dedicated statutory age-verification mechanism was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , a, g, e, , v, e, r, i, f, i, c, a, t, i, o, n, , m, e, c, h, a, n, i, s, m, , m, i, n, o, r, s, , d, a, t, a, , l, a, w.

Education SettingsRed

No education-settings-specific children's-data rules were identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , e, d, u, c, a, t, i, o, n, , s, e, t, t, i, n, g, s, , c, h, i, l, d, r, e, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , r, u, l, e, s.

Dependent AdultsRed

No dependent-adults (elderly/incapacitated) specific data protection provisions were identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , d, e, p, e, n, d, e, n, t, , a, d, u, l, t, s, , v, u, l, n, e, r, a, b, l, e, , p, e, r, s, o, n, s, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , p, r, o, v, i, s, i, o, n, s.

Regulator Powers And PenaltiesGreen

SIC fines can reach up to 2,000 legal monthly minimum wages in force at the time of sanction.

Claims (1):

• Under Law 1581, the fine for breach of data-transfer or data-protection obligations could be equivalent to 2,000 legal monthly minimum wages in force at the time of sanction, a significant penalty in Colombia.

Enforcement Activity IndexGreen

Recent enforcement includes the August 2025 Risks International fine and the historically largest Comcel fine, reflecting active SIC sanctioning practice.

Claims (2):

• On 6 August 2025, the SIC announced a fine of COP 190 million (approx. $47,460) against Risks International S.A.S. for violating Law 1581 of 2012 by managing a database of sensitive personal data without consent.
• On 6 July 2023, the SIC imposed its highest fine to date, COP 1,306,289,600 (approx. $309,072), on Comcel S.A. for unlawful collection of personal data.

Recent Developments 180DGreen

SIC issued Circular Externa No. 003 of 2025 on Model Contractual Clauses effective 19 December 2025, within the 180-day look-back window from the research date.

Claims (1):

• On 19 December 2025, the SIC issued Circular Externa No. 003 of 2025 introducing Model Contractual Clauses for international data transfers, adding a new instrument to Colombia's cross-border transfer framework.

Collective Redress And Class ActionsRed

No dedicated collective-redress or class-action mechanism specific to data protection was identified.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , c, l, a, s, s, , a, c, t, i, o, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , c, o, l, l, e, c, t, i, v, e, , r, e, d, r, e, s, s, , m, e, c, h, a, n, i, s, m.

Private Right Of ActionAmber

Beyond the constitutional habeas data judicial remedy, no distinct statutory private right of action for data protection breaches was confirmed.

Absence provenance: unavailable. Searched: C, o, l, o, m, b, i, a, , p, r, i, v, a, t, e, , r, i, g, h, t, , o, f, , a, c, t, i, o, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , s, t, a, t, u, t, e.

Regulator Funding And CapacityRed

No SIC funding or headcount data was located in this research pass.

Absence provenance: unavailable. Searched: S, I, C, , C, o, l, o, m, b, i, a, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , d, i, v, i, s, i, o, n, , b, u, d, g, e, t, , h, e, a, d, c, o, u, n, t, , f, u, n, d, i, n, g.