Meet Colombia's Law 1581 data protection duties with confidence

Law 1581 of 2012 is Colombia's general personal data protection law. It is a statutory law enacted on 17 October 2012 that develops the constitutional right of habeas data. It sets principles for processing personal data, requires prior and informed authorisation from data subjects, defines sensitive data and children's data rules, grants rights of access, update, rectification and deletion, and restricts transfers to countries without adequate protection. The Superintendence of Industry and Commerce enforces it.

Any public or private organisation that processes personal data held in databases in Colombia must comply, both as a controller and as a processor. The law also applies to controllers or processors outside Colombia when Colombian law applies to them under international rules or treaties. Purely personal or household databases, national security and intelligence databases, journalistic archives and some others are excluded, though the principles still apply to them.

The SIC can fine private controllers and processors up to 2,000 monthly legal minimum wages in force when the sanction is imposed, and fines can be repeated while the breach continues. It can also suspend processing activities for up to six months, order temporary closure if corrections are not made, and order immediate and definitive closure of operations involving sensitive data. Breaches by public authorities are referred to the Inspector General's office.

Some controllers must. Article 25 of Law 1581 created the National Register of Databases (RNBD), a public directory of databases processed in Colombia that is administered by the SIC. Implementing decrees set which controllers must register and the information required, including their data processing policies. Check the current SIC guidance and Decree 1074 of 2015 to confirm whether your organisation falls within the registration obligation.

Yes. Article 17(n) requires controllers, and Article 18(k) requires processors, to inform the data protection authority, the SIC, when there are violations of security codes and risks in the management of data subjects' information. Organisations should have an incident response process that identifies personal data incidents quickly and records the facts needed to report them to the SIC.

Law 1581 shares many ideas with GDPR, including processing principles, data subject rights, special protection for sensitive data and limits on international transfers. Key differences are that Law 1581 relies mainly on prior authorisation from the data subject, uses an adequacy test set by the SIC for transfers, and includes a national database register. GDPR compliance helps, but it does not automatically satisfy Law 1581.

Start by mapping the personal data you process and obtaining valid authorisation where needed. Then adopt a data processing policy and internal manual, publish privacy notices, set up procedures for consultations within 10 working days and complaints within 15 working days, apply security safeguards, manage processors and transfers, register databases if required, and keep evidence that each duty is met.

Yes. OneClickComply supports Colombia's Law 1581 today, mapping its duties to controls with automated evidence collection, AutoComplete policy generation, continuous monitoring and vendor risk management. Our in-house audit team can answer questions through Ask an Auditor. OneClickComply helps you prepare and evidence compliance, but it does not certify compliance or replace legal advice on Colombian law.