Skip to content
AI Policy Generator

ESWhat applies

Colombia · Law

Personal data protection law and its implementing decree

In forceLaw 1581 of 2012

Summary

General personal data law. It applies to AI because it is technology-neutral: it requires a processing policy, consent, demonstrated accountability, database registration, security and safeguards for sending data abroad.

Who it applies to

Any organization that processes personal data in Colombia or about people in Colombia.

Penalties

Fines of up to 2,000 monthly minimum wages, suspension of activities for up to 6 months and closure of processing operations.

Official name
Ley Estatutaria 1581 de 2012, por la cual se dictan disposiciones generales para la protección de datos personales, y Decreto 1377 de 2013
Official reference
Ley 1581 de 2012, Diario Oficial 48.587, 18 de octubre de 2012; Decreto 1377 de 2013 (compilado en el Decreto 1074 de 2015); Decreto 090 de 2018
Regulator
Superintendency of Industry and Commerce (SIC)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Have a data processing policy and consent to use data with AILey 1581 de 2012, arts. 4, 5, 6, 9, 12 y 17; Decreto 1377 de 2013, art. 13In forceAlready applicableAny organization processing personal data in Colombia, including data used or produced by an AI system.Verified in the official source on November 4, 2026
Show compliance through a data management programLey 1581 de 2012, art. 17; Decreto 1377 de 2013, arts. 26 y 27In forceAlready applicableAny organization processing personal data in Colombia.Verified in the official source on November 4, 2026
Register databases in the National Database Registry (RNBD)Ley 1581 de 2012, art. 25; Decreto 090 de 2018In forceAlready applicableCompanies and nonprofits with total assets above 100,000 UVT, and public legal entities.Verified in the official source on November 4, 2026
Send data abroad only with safeguardsLey 1581 de 2012, art. 26In forceAlready applicableOrganizations that send personal data to AI vendors or other third parties outside Colombia.Verified in the official source on November 4, 2026
Report security incidents to the SICLey 1581 de 2012, art. 17, literal n; Circular Única SIC, título V, num. 2.1, lit. f)In forceAlready applicableAny organization processing personal data in Colombia, including incidents in AI systems.Verified in the official source on November 4, 2026

Have a data processing policy and consent to use data with AI

Ley 1581 de 2012, arts. 4, 5, 6, 9, 12 y 17; Decreto 1377 de 2013, art. 13In force

Already applicable

When it relates
Any organization processing personal data in Colombia, including data used or produced by an AI system.
What the rule provides
  • Publish a written data processing policy that explains the purposes, including AI use and automated decisions where they exist.
  • Get prior, express and informed consent; for sensitive data, such as biometric or health data, providing it is optional for the person and needs special care.
  • Respect the rights of children and teenagers.
Typical evidence
  • Published processing policy and proof of consent
Verification
Verified in the official source on November 4, 2026Checked against the official text: Law 1581 of 2012 (Senate Secretariat), arts. 4, 5, 6, 9, 12 and 17; Decree 1377 of 2013, art. 13 (Función Pública).

Show compliance through a data management program

Ley 1581 de 2012, art. 17; Decreto 1377 de 2013, arts. 26 y 27In force

Already applicable

When it relates
Any organization processing personal data in Colombia.
What the rule provides
  • Keep a comprehensive personal data management program with owners, procedures and controls, and be able to show it to the SIC (demonstrated accountability).
  • Build privacy by design into AI projects.
Typical evidence
  • Documented program, processing inventory and control records
Verification
Verified in the official source on November 4, 2026Checked against the official text: Law 1581 of 2012 (Senate Secretariat), art. 17; Decree 1377 of 2013, arts. 26 and 27 (Función Pública).

Register databases in the National Database Registry (RNBD)

Ley 1581 de 2012, art. 25; Decreto 090 de 2018In force

Already applicable

When it relates
Companies and nonprofits with total assets above 100,000 UVT, and public legal entities.
What the rule provides
  • Register each database, including those feeding AI systems, and keep the information up to date.
Typical evidence
  • Registration certificate and updates
Verification
Verified in the official source on November 4, 2026Checked against the official text: Law 1581, art. 25 (Senate Secretariat) and Decree 090 of 2018 (Función Pública), which limits registration to companies and nonprofits with total assets above 100,000 UVT and to public legal entities. The questionnaire approximates the threshold with companies of 250 or more people.

Send data abroad only with safeguards

Ley 1581 de 2012, art. 26In force

Already applicable

When it relates
Organizations that send personal data to AI vendors or other third parties outside Colombia.
What the rule provides
  • Transfer only to countries with adequate protection or when a legal exception applies (for example, the person's express consent) or the SIC issues a declaration of conformity.
  • Sign data transmission agreements with processors abroad.
Typical evidence
  • File for each transfer and signed agreements
Verification
Verified in the official source on November 4, 2026Checked against the official text: Law 1581 of 2012 (Senate Secretariat), art. 26 (ban and exceptions).

Report security incidents to the SIC

Ley 1581 de 2012, art. 17, literal n; Circular Única SIC, título V, num. 2.1, lit. f)In force

Already applicable

When it relates
Any organization processing personal data in Colombia, including incidents in AI systems.
What the rule provides
  • Inform the SIC when security codes are breached or there are risks in managing people's information.
  • Report the incident to the SIC: controllers that must register their databases in the RNBD report it there within 15 business days of detection; other controllers and processors use the SIC's online form.
Typical evidence
  • Incident log and proof of reporting
Supporting documents
Verification
Verified in the official source on November 4, 2026Checked against Law 1581, art. 17, literal n (Senate Secretariat), and the SIC Single Circular, title V, item 2.1(f)(ii), version published by the SIC in 2018: "fifteen (15) business days" for RNBD-registered controllers. Check whether the SIC has updated that item.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)