Colombia. Comprehensive data protection. Law
Law 1581Statutory Law No. 1581 of 2012 on general provisions for personal data protection (Ley Estatutaria 1581 de 2012)
§1Summary
- Synopsis
Colombia's general data protection law grounded in the constitutional habeas data right. It requires prior, express and informed authorisation, privacy policies, rights handling and security, and restricts transfers to countries without adequate protection.
- Key themes
- Unique features
Mandatory registration of databases in the National Register of Databases (RNBD) for larger companies; SIC actively enforces against foreign platforms, asserting jurisdiction over data collected via devices in Colombia.
- SaaS relevance
SIC has applied the law to foreign online services collecting data from users in Colombia, so SaaS providers targeting Colombia should expect coverage.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- SIC within 15 business days of detection
- DPO
- Conditional
- Cross-border transfers
- Adequate countries list (SIC), contracts/transmission agreements, consent
- Maximum penalty
- Up to 2,000 monthly minimum wages; temporary or permanent closure
§3Dates
- Key dates
- Adopted
- In force
- Decree 1377/2013 and Decree 886/2014 (RNBD) compiled into Decree 1074/2015; SIC External Circular 003/2025 on SCCs
§4Text and authority
- Text
- Authoritative text funcionpublica.gov.co
- Authority
- Superintendencia de Industria y Comercio (SIC) - Delegatura para la Protección de Datos Personales
§5Where it applies
- Domestic law of
- Colombia
§6Sources and verification
- Verification
High confidence.
'DPO' = designated person/area for data protection (accountability guide).