Colombia Personal Data Protection Law — Law 1581 of 2012
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentLawSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionLatin AmericaRegion DetailColombiaPublisherCongress of Colombia (supervised by the Superintendencia de Industria y Comercio)
- VersioningVersionLey Estatutaria 1581 de 2012; regulated by Decreto 1377 de 2013 (compiled in Decreto 1074 de 2015) and Decreto 886 de 2014Effective DateOctober 2012 (on promulgation, article 30)Issue DateOctober 17, 2012
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
Ley Estatutaria 1581 de 2012 is a public law published in the Diario Oficial and available free from the SIC, the Senate of Colombia and Función Pública.
Framework text is licensed by its publisher and is included only where stated above.
- Ley Estatutaria 1581 de 2012 is Colombia's general personal data protection law, supervised by the Superintendencia de Industria y Comercio (SIC).
- It requires prior, express, and informed authorization from the data subject and respects the habeas data right to know, update, and rectify.
- Consultas are answered within 10 business days and reclamos within 15, and databases above 100,000 UVT in assets are registered in the RNBD.
- Fines reach 2,000 monthly minimum wages, and the SIC can order a temporary block of data.
- SmartSuite holds the database inventory, authorizations, the consulta and reclamo log, and the evidence the SIC can request.
Overview
Ley Estatutaria 1581 de 2012 is Colombia's general personal data protection law. It requires public and private entities that process personal data in Colombia to obtain prior, express and informed authorization from the data subject (titular), to respect the habeas data right to know, update and rectify data, and to answer to the Superintendencia de Industria y Comercio (SIC). The law is dated October 17, 2012, and took effect on promulgation (Diario Oficial 48.587, October 18, 2012); article 28 gave existing processors six months to adapt.
The Congress of Colombia enacted the law, and the SIC supervises it through its Delegatura para la Protección de Datos Personales (article 19). Decreto 1377 of 2013, now compiled in Chapter 25 of Decreto 1074 of 2015, adds rules on authorization, privacy notices, processing policies and demonstrated accountability. The Registro Nacional de Bases de Datos (RNBD) rules sit in Chapter 26 of the same decree, as amended by Decreto 090 of 2018.
Controllers (responsables) and processors (encargados) implement the law by documenting authorization for each purpose, publishing a processing policy, answering consultas within 10 business days and reclamos within 15, designating a person or area for data protection requests, signing transmission contracts with processors, and registering databases in the RNBD when they hold assets above 100,000 UVT or are public legal entities.
Why does it matter?
Law 1581 turns the constitutional habeas data right into duties that a controller can be held to: authorization before processing, rights the titular can use free of charge, and an authority that can fine, suspend and close operations. Fines reach 2,000 monthly minimum wages (article 23), and the SIC can order a temporary block of data (article 21).
Key benefits include:
- A clear lawful basis
Processing needs prior, express and informed authorization kept in a form that can be consulted later (articles 4 and 9), with narrow exceptions such as public data and medical emergencies (article 10).
- Rights with deadlines
A titular can consult data and expect an answer within 10 business days, and can file a claim to correct, update or delete within 15 business days, each with one limited extension (articles 14 and 15).
- Accountability the SIC can test
Decreto 1377 requires controllers to show, when the SIC asks, that they have effective measures in place, and the SIC takes those measures into account when it sets sanctions (articles 26 and 27).
- Care for sensitive data and minors
Sensitive data may be processed only in the cases listed in article 6, and children's data only where it is public or the processing respects their best interests and fundamental rights (article 7; Decreto 1377, article 12).
- Rules for cross-border transfers
Transfers to countries without adequate protection are prohibited unless an exception in article 26 applies or the SIC issues a declaration of conformity.
How does it work?
The law has nine titles. Title I sets the purpose, scope and definitions (articles 1 to 3); Title II the eight principles (article 4); Title III special categories of data (articles 5 to 7); Title IV rights and conditions for lawful processing (articles 8 to 13); Title V consultations and claims (articles 14 to 16); Title VI the duties of controllers and processors (articles 17 and 18); Title VII supervision, sanctions and the RNBD (articles 19 to 25); Title VIII transfers abroad (article 26); and Title IX other provisions (articles 27 to 30).
Implementation follows the data lifecycle. The controller obtains authorization and tells the titular the purpose, that answers on sensitive or children's data are optional, the titular's rights and the controller's contact details (article 12). It adopts an internal manual of policies and procedures (article 17(k)), publishes a processing policy or privacy notice (Decreto 1377, articles 13 and 14), and signs a transmission contract with each processor (Decreto 1377, article 25).
In SmartSuite, teams can keep the database inventory and authorization records in Privacy Management, track consultas and reclamos against their deadlines, follow processor contracts in Third Party Risk Management, and hold controls and evidence for SIC requests in Compliance Management.
Key Elements
- Eight principles (article 4)
Legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality. Personal data, other than public information, may not be available on the Internet unless access is technically controllable.
- Titular rights (article 8)
The titular may know, update and rectify data, request proof of the authorization, be told how the data was used, complain to the SIC, revoke authorization or request deletion, and access the data free of charge.
- Special categories (articles 5 to 7)
Sensitive data affects privacy or can lead to discrimination, and includes racial or ethnic origin, political orientation, religious or philosophical convictions, union membership, health, sex life and biometric data. Its processing is prohibited except in the five cases in article 6, and children's data may be processed only if public (article 7).
- Duties of controllers and processors (articles 17 and 18)
Controllers must guarantee habeas data, keep the authorization, secure the data, adopt an internal manual, report security-code violations to the SIC and follow its instructions. Processors must update reported data within five business days and report violations to the SIC.
- Authority and sanctions (articles 19 to 24)
The SIC investigates, can block data temporarily and can impose fines up to 2,000 monthly minimum wages, suspension for up to six months, temporary closure and immediate closure of operations processing sensitive data. For public authorities it refers the case to the Procuraduría General de la Nación (article 23, paragraph).
- Registro Nacional de Bases de Datos (article 25)
The RNBD is the public directory of databases, administered by the SIC, and registration requires the processing policies. Since Decreto 090 of 2018, companies and non-profits with total assets above 100,000 UVT, and public legal entities, must register; databases created later must register within two months.
- International transfers (article 26)
Transfers are prohibited to countries without adequate protection unless the titular gave express authorization or another listed exception applies. Under Decreto 1377, article 24, a transmission to a processor under the article 25 contract needs no new consent.
What does it cover?
Law 1581 applies to personal data in any database handled by public or private entities, to processing in Colombian territory, and to controllers or processors abroad when Colombian law applies to them under norms or treaties (article 2). It excludes databases kept for purely personal or domestic use, national security and defense, money laundering and terrorist financing control, intelligence, journalistic and editorial content, and databases governed by Law 1266 of 2008 or Law 79 of 1993. The principles still apply to those databases within the limits of the law.
What are its objectives?
The law develops the habeas data right in article 15 of the Constitution and the right to information in article 20 (article 1).
Guarantee every person the right to know, update and rectify information held about them in databases or files.
Require prior, express and informed authorization for processing, with the exceptions listed in article 10.
Bind public and private controllers and processors to the eight principles in article 4.
Give titulares free, time-limited ways to consult and claim (articles 14 and 15).
Make the SIC the data protection authority, with powers to investigate, block data and sanction (articles 19 to 24).
Restrict transfers of data to countries without adequate protection (article 26).
Framework in Context
The Constitutional Court reviewed the bill in Sentencia C-748 of 2011 before it became Law 1581. Its regulation is in Decreto 1377 of 2013 and Decreto 886 of 2014, now compiled in Decreto 1074 of 2015. Law 1266 of 2008 on financial and credit information stays outside it under article 2. The Senate's consolidated text, updated on September 30, 2026, shows the articles unchanged, although reform bills have been filed in Congress.
Common Framework Mappings
Organizations that handle Colombian personal data alongside other regimes map Law 1581 to those instruments to reuse controls and evidence.
Mapped frameworks include:
APEC PF
LGPD
Convention 108+
GDPR
ISO 27001:2022
ISO 27002:2022
ISO 27701
NIST Privacy Framework v1.0
How SmartSuite Supports Law 1581 of 2012
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management, Third Party Risk Management and Compliance Management records to hold the database inventory, the authorizations, the consulta and reclamo log and the evidence the SIC can request.
Database and Authorization Register
Record each base de datos, its purpose, the authorization obtained for it and whether it holds sensitive or children's data (articles 5 to 9).
Consulta and Reclamo Workflow
Track each consulta against the 10 business day deadline and each reclamo against the 15 business day deadline, including the "reclamo en trámite" legend and extension notices (articles 14 and 15).
Processing Policy and Privacy Notice Control
Version the política de tratamiento and the aviso de privacidad, and keep evidence that titulares received them (Decreto 1377, articles 13 to 16).
Processor Contracts and Transfers
Hold each transmission contract with an encargado and the legal route for any international transfer, including the article 26 exceptions or an SIC declaration of conformity.
Security Incident Log
Log security-code violations and the report to the SIC required by articles 17 and 18, with cause, data affected and remediation.
RNBD and Accountability Reporting
Track RNBD registration and updates, and build dashboards showing the evidence of effective measures that the SIC can request under Decreto 1377, article 26.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
Frequently Asked Questions For Colombia Personal Data Protection Law (Law 1581 of 2012)
Public and private entities that process personal data in Colombia, and controllers or processors outside Colombia when Colombian law applies to them under norms or treaties (article 2). The law excludes databases kept for personal or domestic use and several categories such as national security, intelligence, journalism and databases governed by Law 1266 of 2008.
It must obtain prior, express and informed authorization in a way that can be consulted later (articles 4 and 9). At collection it must state the purpose, that answers on sensitive or children's data are optional, the titular's rights and its own contact details (article 12). Decreto 1377 accepts authorization in writing, orally or by unequivocal conduct, never by silence (article 7).
A consulta must be answered within 10 business days, extendable once by up to 5 business days with reasons (article 14). A reclamo to correct, update or delete data must be answered within 15 business days, extendable by up to 8 (article 15). A titular may complain to the SIC only after using these steps (article 16).
The SIC, through its Delegatura para la Protección de Datos Personales (article 19). Against private entities it can impose fines of up to 2,000 monthly minimum wages, suspension of processing for up to six months, temporary closure and immediate closure of operations that process sensitive data (article 23). Cases against public authorities go to the Procuraduría General de la Nación.
Article 25 created the Registro Nacional de Bases de Datos, administered by the SIC. Under Decreto 090 of 2018, companies and non-profits with total assets above 100,000 UVT, and public legal entities, must register; databases created later must register within two months. Other controllers are still bound by Law 1581.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.