Colombia Data Protection: Law 1581 and SIC Enforcement

Controllers (responsables) and processors (encargados) processing personal data in Colombian territory, or where Colombian law applies by treaty. The SIC has applied the regime to foreign companies with Colombian operations, establishments, or processing directed at Colombia; a purely offshore website is harder to reach, but local subsidiaries, apps operating in Colombia, and vendors serving Colombian controllers are squarely covered. Financial and credit data runs on the separate Law 1266 track with its own rules and the same regulator.

Prior and informed authorization is required before collection, demonstrable by the controller, with notice of the purposes, the optional nature of sensitive-data questions, rights, and the controller's identity. Exceptions are narrow: legal or judicial requirement, public registries, medical emergencies, statistical/historical/scientific purposes with dissociation. Sensitive data (health, biometrics, political and religious views, union membership, sex life, and data of children and adolescents) needs express authorization, and processing children's data is only lawful when it serves the minor's best interest and fundamental rights.

The National Database Registry, a public directory of databases run by the SIC. After successive scope reductions (Decree 090 of 2018), registration is mandatory for companies and non-profits with total assets above 100,000 UVT (an inflation-indexed unit), and for public entities. Registrants describe each database's purposes, data categories, security measures, international transfers, and processor relationships, and must report substantial changes and update annually. Breach incidents must also be reported through the RNBD, which is how the SIC learns of security failures.

The SIC's data protection delegatura issues dozens of sanctions annually. Recurring patterns: marketing calls and messages without valid authorization (the largest category), security failures exposing customer data, ignoring deletion requests, and processing beyond the authorized purposes. Rappi has been fined repeatedly (including sanctions upheld in 2023-2024) over authorization and information duties; banks and telecoms feature constantly. Fines reach 2,000 current monthly minimum wages (about USD 700,000), and the SIC can also order suspension of processing or closure of databases, remedies it has used against non-cooperative controllers.

Transfers of personal data abroad require the destination to provide adequate protection, per SIC Circular Externa 005 of 2017, which lists countries the SIC considers adequate (including the US for certain frameworks, EU members, and several others), or a covered exception: express authorization from the data subject, medical necessity, banking transfers, treaty obligations, or contract performance. Transmissions to processors acting for a Colombian controller can instead rely on a transmission contract meeting Decree 1377 requirements. Map which mechanism covers each flow; authorization is the fallback but fragile at scale.