Data protection & privacy law in Colombia (2026)

The SIC issued binding guidelines requiring banks, fintechs, and collection agencies to adopt verifiable accountability frameworks, formalise data-transmission contracts, and reference Ibero-American model clauses for international transfers; elevates 'demonstrated responsibility' from a statutory principle to an auditable obligation with 13 enumerated compliance instructions.

The Colombian government (MinComercio + MinCiencias) and a congressional bloc filed competing bills to modernise Law 1581 of 2012, introducing multiple legal bases for processing, rights to portability and to object to automated decisions, extraterritorial scope with a mandatory local representative, child-data protections, and fines up to 5% of annual operational revenue, the most significant reform attempt since the 2012 framework.

Colombia's data protection authority issued its first AI-specific guidance, requiring that personal data used to develop, train, or deploy AI systems satisfy suitability, necessity, reasonableness, and proportionality; mandates privacy-by-design integration, documented risk assessments, and auditable human oversight mechanisms for AI pipelines.

The SIC updated the annual compliance cycle for the Registro Nacional de Bases de Datos, clarifying that entities with assets above 100,000 UVT and all public bodies must register and report on cross-border data flows, security incidents, and updated security measures each first quarter, raising the bar for demonstrable compliance tracking.

The SIC fined América Móvil subsidiary Claro (Comcel S.A.) COP $1,306,289,600, then the highest privacy fine in Colombian history, for harvesting third-party mobile numbers through its 'Amigos que te premian' referral campaign without prior, express, and informed consent, aggravated by the company's recidivism from a prior sanction for the same violation.

The SIC created the mandatory National Registry of Personal Databases, requiring private and public data controllers to register all personal databases, declare data categories and security measures, and report on cross-border transfers; annual updates became obligatory from 2018, making the RNBD a core accountability and supervisory tool.

Decree 1074/2015 compiled Decree 1377/2013 and other scattered secondary regulations into a single Regulatory Decree for the commerce sector, eliminating fragmentation and giving the data-protection implementing rules a stable, codified reference that remains the operative secondary framework today.

The government issued the primary secondary regulation for Law 1581, specifying valid-consent requirements, mandatory content of privacy policies and security manuals, procedures for exercising data-subject rights, and conditions for international data transfers, providing the operational rulebook that made compliance with the 2012 law practicable.

Congress enacted the comprehensive personal data protection framework covering all databases held by public and private entities in Colombian territory; mandated prior express informed consent, established sensitive-data categories (health, political opinion, etc.), defined data-subject rights (know, update, rectify, delete), and formally designated the SIC as the national supervisory authority.

As constitutionally required for all statutory laws, the Court examined the draft of Law 1581 before promulgation, conditionally upholding it and clarifying the constitutional limits on processing sensitive data and children's personal information, its conditions directly shaped the final text and created binding interpretive precedent for the entire framework.

The newly constituted Constitutional Court ruled in Sentence T-414 that protection of personal financial data constitutes a fundamental individual right, coining the doctrine of 'informatic self-determination' under Article 15 of the 1991 Constitution, opening the door for citizens to seek immediate tutela relief against improper data processing for the next two decades before any statutory law existed.

Colombia's new Constitution guaranteed every person the right to know, update, and rectify information held about them in public or private databases, alongside rights to privacy and correspondence, establishing the constitutional bedrock that made data protection a fundamental right justiciable before the Constitutional Court and mandating later statutory legislation.