Countries › Colombia › Guide › 13. Regulation › Personal data protection in Colombia: consent, sensitive data, data subject requests, database registry (RNBD), international transfers and SIC sanctions

Personal data protection in Colombia: consent, sensitive data, data subject requests, database registry (RNBD), international transfers and SIC sanctions

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-27 · Status: Stable

Ley Estatutaria 1581 de 2012 requires prior, informed and provable consent for processing personal data, bans processing of children's data except public data, restricts sensitive data, and obliges controllers to answer access requests in 10 business days and complaints in 15. Companies with assets above 100,000 UVT (COP 5,237,400,000 in 2026, about US$1.7 million) must register each database in the SIC's RNBD; transfers abroad are only allowed to countries the SIC lists as adequate (including the United States, the United Kingdom, Mexico, Peru, EU members and countries the European Commission deems adequate), under an exception, or with an SIC declaration or a transfer contract notified to the SIC. The SIC can fine up to 2,000 pre 2024 minimum wages (COP 2,809,520,000, about US$889,700), repeatedly while the breach continues, suspend processing for 6 months or close operations with sensitive data.

USD figures use the TRM (tasa representativa del mercado) of COP 3,157.94 per US dollar, valid 27 October 2026, from the official TRM series published by the Superintendencia Financiera on the national open data portal. Conversions are for orientation only.

Key facts

Maximum data protection fine per sanction in 2026 pesos (232,000 UVB)	2809520000 COPLey 1581 de 2012 art. 23; Ley 2294 de 2023 art. 313, as of 2026-10-27 · in force
Total assets above which companies must register databases in the RNBD	100000 UVTDecreto 1074 de 2015 art. 2.2.2.26.1.2 (Decreto 90 de 2018), as of 2026-10-27 · in force
Deadline to register a new database in the RNBD	2 monthsDecreto 1074 de 2015 art. 2.2.2.26.3.1, as of 2026-10-27 · in force
Term to answer a data subject access request (extendable by 5)	10 business daysLey 1581 de 2012 art. 14, as of 2026-10-27 · in force
Term to resolve a data subject complaint (extendable by 8)	15 business daysLey 1581 de 2012 art. 15, as of 2026-10-27 · in force
Maximum suspension of data processing activities	6 monthsLey 1581 de 2012 art. 23, as of 2026-10-27 · in force

The rule

1. The law applies to personal data in any database processed by public or private entities, to processing in Colombian territory, and to controllers or processors not established in Colombia when Colombian law applies to them under international rules or treaties. It does not apply to purely personal or household databases, national security and AML/CFT databases, intelligence, journalism, or databases under Ley 1266 de 2008 (financial habeas data) and Ley 79 de 1993, although its principles still apply to them.Ley Estatutaria 1581 de 2012, Art. 2, 2012-10-17 official text · verified 2026-10-27

2. Processing must follow the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality; personal data other than public data may not be made available on the internet unless access is technically controlled. Processing requires the data subject's prior and informed authorization obtained by any means that can be checked later. Authorization is not needed for information requested by a public authority or court, public data, medical emergencies, historical, statistical or scientific uses authorized by law, and civil registry data. When requesting consent the controller must state the processing and purpose, the optional nature of answers on sensitive or children's data, the data subject's rights and its own identification and contact details, and keep proof.Ley Estatutaria 1581 de 2012, Art. 4, 9, 10 and 12, 2012-10-17 official text · verified 2026-10-27

3. Sensitive data (racial or ethnic origin, political orientation, religious or philosophical beliefs, union or social organization membership, health, sex life and biometric data) may not be processed except with explicit authorization, to protect a vital interest of an incapacitated data subject, by non profits within their members, to exercise or defend rights in court, or for historical, statistical or scientific purposes with anonymization. Processing personal data of children and adolescents is prohibited except public data.Ley Estatutaria 1581 de 2012, Art. 5, 6 and 7, 2012-10-17 official text · verified 2026-10-27

4. Data subjects may know, update and rectify their data, request proof of authorization, be told how their data is used, complain to the SIC, revoke authorization or request deletion when processing breaches the law, and access their data free of charge (at least once per calendar month and whenever the policy changes substantially). Access requests must be answered within 10 business days, extendable by 5 with notice; complaints (correction, update, deletion or breach) within 15 business days, extendable by 8, with a 'claim in process' note added to the record within 2 business days.Ley Estatutaria 1581 de 2012; Decreto 1074 de 2015, Ley 1581 art. 8, 14 and 15; Decreto 1074 art. 2.2.2.25.4.2, 2012-10-17 official text · verified 2026-10-27

5. Controllers must, among other duties, keep a copy of each authorization, keep data secure, process only authorized data through processors, adopt an internal manual of policies and procedures including for requests and complaints, inform the SIC when security codes are breached and there are risks to data subjects, and follow SIC instructions. Under the accountability principle, controllers must be able to show the SIC that they have implemented appropriate and effective measures.Ley Estatutaria 1581 de 2012; Decreto 1074 de 2015, Ley 1581 art. 17; Decreto 1074 art. 2.2.2.25.6.1, 2012-10-17 official text · verified 2026-10-27

6. Companies and non profit entities with total assets above 100,000 UVT, and public legal entities, must register each database containing personal data in the Registro Nacional de Bases de Datos (RNBD) run by the SIC, with their data processing policy; databases created after the initial deadlines must be registered within 2 months of creation, and registered information must be updated when there are substantial changes.
Cost to do it: Registration in the RNBD has no fee stated in the regulation; the trigger is total assets above 100,000 UVT, COP 5,237,400,000 (about US$1.7 million) at the 2026 UVT of COP 52,374.Ley Estatutaria 1581 de 2012; Decreto 1074 de 2015 (as amended by Decreto 90 de 2018), Ley 1581 art. 25; Decreto 1074 art. 2.2.2.26.1.2, 2.2.2.26.1.3, 2.2.2.26.3.1 and 2.2.2.26.3.3, 2018-01-18 official text · verified 2026-10-27

7. Transferring personal data to countries without adequate protection is prohibited, except with the data subject's express and unequivocal authorization, medical data exchanges, bank or stock exchange transfers, transfers under treaties, transfers needed to perform a contract with the data subject (with authorization), or transfers legally required to safeguard the public interest or a right in court. In other cases the SIC issues a declaration of conformity. Transmissions to a processor abroad do not require informing the data subject or consent if there is a data transmission contract setting the scope, the processor's duties and confidentiality.Ley Estatutaria 1581 de 2012; Decreto 1074 de 2015, Ley 1581 art. 26; Decreto 1074 art. 2.2.2.25.5.1 and 2.2.2.25.5.2, 2012-10-17 official text · verified 2026-10-27

8. The SIC's list of countries with an adequate level of protection includes Germany, Austria, Belgium, Bulgaria, Cyprus, Costa Rica, Croatia, Denmark, Slovakia, Slovenia, Estonia, Spain, the United States, Finland, France, Greece, Hungary, Ireland, Iceland, Italy, Latvia, Lithuania, Luxembourg, Malta, Mexico, Norway, the Netherlands, Peru, Poland, Portugal, the United Kingdom, the Czech Republic, South Korea, Romania, Serbia, Sweden, and the countries declared adequate by the European Commission. Even for listed countries the controller must be able to show adequate safeguards. Where a controller signs a transfer contract or similar instrument guaranteeing the principles, it may transfer after a prior communication to the SIC's data protection unit declaring that the contract exists. Mere transit of data through other countries is not a transfer.SIC Circular Externa 005 de 2017 (adds Chapter Three to Title V of the Circular Única), Num. 3.2 and 3.3, 2017-08-10 official text · verified 2026-10-27

9. The SIC may impose on private controllers and processors personal and institutional fines of up to 2,000 monthly minimum wages, successive while the breach continues; suspension of processing for up to 6 months with corrective orders; temporary closure if corrections are not made; and immediate and permanent closure of operations involving sensitive data. Criteria include the harm or risk, the economic benefit, recidivism, obstruction, disregard of orders and express admission before the sanction.
Cost to do it: Maximum fine per sanction in 2026: COP 2,809,520,000 (about US$889,700), repeatable while the breach continues.Ley Estatutaria 1581 de 2012, Art. 23 and art. 24, 2012-10-17 official text · verified 2026-10-27

10. From 1 January 2024, fines, sanctions and thresholds previously set in monthly minimum wages are calculated through their equivalent in Unidades de Valor Básico (UVB), at 2023 values (one 2023 minimum wage of COP 1,160,000 equals 116 UVB of COP 10,000); tax, customs and exchange control amounts in UVT are excluded. The 2026 UVB is COP 12,110 (Resolución MinHacienda 3488 of 31 December 2025), so each pre 2024 minimum wage cap is worth COP 1,404,760 in 2026.Ley 2294 de 2023 (Plan Nacional de Desarrollo), Art. 313, 2023-05-19 official text · verified 2026-10-27

Route	Basis	What is needed
Destination on the SIC adequacy list (for example the United States, Mexico, Peru, EU, United Kingdom, or a country the European Commission deems adequate)	Circular Externa 005 de 2017 num. 3.2	Accountability evidence of safeguards
Statutory exception (express consent, contract with the data subject, treaty, banking, medical, legal claims)	Ley 1581 art. 26	Proof the exception applies
Transfer contract or similar instrument	Circular Externa 005 de 2017 num. 3.3 par.	Prior communication to the SIC declaring the contract
Declaration of conformity	Ley 1581 art. 26 par. 1	SIC decision on a filed request
Transmission to a processor acting for the controller	Decreto 1074 art. 2.2.2.25.5.1 and 2.2.2.25.5.2	Data transmission contract with the processor

Routes to send personal data abroad from Colombia

Worked example

A Colombian SAS with COP 8,000,000,000 in assets (above the COP 5,237,400,000 RNBD threshold) runs a customer database on a US cloud provider and shares HR data with its parent in Argentina. It registers both databases in the RNBD with its policy; the cloud provider acts as processor under a transmission contract; the HR data goes to Argentina, a country the European Commission deems adequate, which falls within the SIC list, and the company keeps evidence of safeguards. A breach of these rules could cost up to COP 2,809,520,000 (about US$889,700) per sanction.

Step by step

Inventory all databases with personal data and identify controllers, processors and purposes.
Adopt and publish a data processing policy and an internal procedures manual; set up channels to answer access requests in 10 business days and complaints in 15.
Collect consent in a verifiable form with the art. 12 notice; separate sensitive data and avoid processing children's data except public data.
If assets exceed 100,000 UVT, register each database in the RNBD and register new ones within 2 months.
Classify each international flow as transmission or transfer, sign transmission contracts with processors, and for transfers check the SIC list, an exception, or notify a transfer contract to the SIC.
Set up an incident process to inform the SIC of security breaches that create risks for data subjects.

Common traps

Consent must be provable later; implied consent from continued use is risky.
The law can reach controllers abroad when Colombian law applies to them.
Fines can be repeated while a breach continues, and there is a separate permanent closure sanction for sensitive data operations.
Financial and credit data follows Ley 1266 de 2008, a separate habeas data regime, while the transfer rule in Ley 1581 art. 26 also applies to it.
Being on the adequacy list does not remove the duty to prove safeguards under the accountability principle.

Sources

← Consumer protection in Colombia: legal guarantee, information and advertising, abusive clauses, five day withdrawal right, payment reversal, e-commerce duties and SIC finesAnti bribery in Colombia: corporate liability for transnational bribery (Ley 1778), sanctions for domestic corruption offences, private corruption and self reporting benefits →