Colombia Data Protection Law Guide: Law 1581, SIC Registration and Security Incidents

Colombia's data protection regime is built on consent, registration and a 15 business day incident report to the regulator, and organisations that treat it as a lighter version of GDPR tend to miss all three. Statutory Law 1581 of 2012 sets the principles and rights, Decree 1377 of 2013 (now compiled in the sector Decree 1074 of 2015) fills in the detail, and the Superintendencia de Industria y Comercio (SIC) supervises, runs the national database register and issues binding instructions. This guide covers scope, obligations, status as of October 2026, enforcement, AI agents and machine credentials, and a phased plan, for security, privacy and engineering leads. For the cross-country view, see the Global Privacy Regulatory Map.

Key takeaways

• Consent is the default basis: Law 1581 requires prior, express and informed authorisation from the data subject unless one of the narrow Art. 10 exceptions applies, so there is no general "legitimate interests" route for security or analytics processing.
• Security incidents go to the SIC: Art. 17(n) obliges controllers to inform the authority of violations of security codes, and SIC instructions set the report through the national database register within 15 business days of detection.
• Many organisations must register databases: companies and non-profits with total assets above 100,000 UVT, and all public legal persons, must register each database in the Registro Nacional de Bases de Datos (RNBD) and keep it updated.
• Transfers need a lawful route: Art. 26 prohibits transfers to countries without an adequate level of protection unless an exception applies or the SIC issues a declaration of conformity; the SIC publishes its own list of adequate countries.
• Accountability is what reduces fines: fines reach 2,000 monthly minimum wages per sanction, and demonstrable accountability measures under Decree 1377 Arts. 26 and 27 are taken into account when the SIC grades a sanction.

Scope: who and what is covered

Law 1581 applies to personal data recorded in any database that makes it susceptible to processing by public or private entities, where the processing takes place in Colombian territory, or where the controller or processor is not established in Colombia but Colombian law applies to it under international rules and treaties (Art. 2). Asset thresholds only decide who must register databases.

Transfer versus transmission: Decree 1377 distinguishes a transfer (sending data to a recipient who is itself a controller, inside or outside Colombia) from a transmission (sending data to a processor who acts for the controller). A transmission under a written contract that meets Art. 25 needs no separate consent, which is the basis on which most cloud and outsourcing arrangements run.

Key obligations

Principles, authorisation and notice

Art. 4 sets eight principles: legality, purpose, freedom, veracity or quality, transparency, restricted access and circulation, security, and confidentiality. In practice they translate into four duties that touch security teams.

• Authorisation: obtain authorisation no later than the time of collection, disclose the data collected and the specific purposes, and keep evidence of it (Decree 1377 Arts. 5 and 8). Consent may be written, oral or given by unequivocal conduct, but silence never counts (Art. 7).
• Exceptions: Art. 10 removes the need for authorisation for information required by a public entity exercising its legal functions, public data, medical or health emergencies, processing authorised by law for historical, statistical or scientific purposes, and civil registry data.
• Sensitive data: tell the data subject that answering is optional and which items are sensitive, obtain explicit consent, and never condition a service on it (Decree 1377 Art. 6). Biometric access control falls here.
• Policies and privacy notice: a written information processing policy (Decree 1377 Art. 13) with the controller's identity, purposes, rights, the person or area handling requests, the procedure and the effective date; a shorter privacy notice (aviso de privacidad) where the full policy cannot be shown at collection (Arts. 14 to 17).

Security duties

Law 1581 is short on technical detail but firm on outcome. Art. 17(d) requires the controller to keep information under the security conditions needed to prevent its alteration, loss, consultation, use or unauthorised or fraudulent access, and Art. 18 imposes the same on processors. Art. 17(n) adds the duty to inform the data protection authority when security codes are violated and there are risks in the administration of data subjects' information.

The SIC has applied the same expectation to AI. Its Circular Externa 002 of 2024 (dated 21 August 2024) says security measures must be technical, human, administrative, physical and contractual, and auditable.

Data subject requests and their clocks

RNBD registration and incident reporting

Decree 090 of 2018 amended Decree 1074 of 2015 (Arts. 2.2.2.26.1.2 and 2.2.2.26.3.1) so that companies and non-profit entities with total assets above 100,000 UVT (Unidad de Valor Tributario, the tax unit indexed each year) and all public legal persons must register their databases. Micro and small enterprises and natural persons are excluded from registration, but not from the rest of Law 1581. New databases must be registered within two months of creation.

Who reports incidents: according to Holland & Knight's summary of the 2018 SIC instructions, the 15 business day report also applies to controllers and processors not obliged to register. Incident reports are not public. Compare the Colombian clock with others in the Breach Notification Laws by Country Guide.

Notifying data subjects: Law 1581 sets no general deadline for telling affected individuals; decide case by case and record the reasoning.

International transfers

Art. 26 prohibits transfers to countries that do not provide adequate protection, measured against SIC standards. The exceptions are: express and unequivocal authorisation by the data subject; exchange of medical data; bank or stock market transfers; transfers under treaties to which Colombia is a party; transfers needed to perform a contract between the data subject and controller, or pre-contractual measures, with authorisation; and transfers legally required for the public interest or for legal claims. Outside those cases the controller must ask the SIC for a declaración de conformidad.

SIC Circular Externa 005 of 10 August 2017 listed the countries the SIC considers adequate, including the United States, Mexico, Peru, Spain, France, Germany and the United Kingdom. Transmissions to processors abroad run on the Decree 1377 Art. 25 contract instead. See the International Data Transfers Map for how this sits beside GDPR and LGPD mechanisms.

Demonstrated accountability

Decree 1377 Arts. 26 and 27 require controllers to be able to show the SIC, on request, that they have appropriate and effective measures, scaled to the size of the entity, the type of data and processing, and the risks. The SIC's accountability guidelines (responsabilidad demostrada, 2015) are not mandatory, but following them is considered when sanctions are graded. Circular 002 of 2024 makes a documented privacy impact assessment the expectation before designing AI products that are likely to be high risk; the DPIA Guide covers the method.

Timeline and current status

Status as of October 2026: Law 1581 remains the governing statute. The reform announced in August 2025 had not been enacted in any source reviewed for this guide; if it passes it will need review by the Constitutional Court as a statutory law before taking effect, so check the SIC site before relying on the rules described here.

Enforcement and penalties

The SIC acts through its Delegatura para la Protección de Datos Personales (Art. 19). It can investigate on complaint or on its own initiative, order corrective measures, temporarily block data where there is a risk of serious harm, issue instructions and run the RNBD (Art. 21).

Sanctions under Art. 23 apply to private persons; for public entities the SIC refers the matter to the Procuraduría. Art. 24 grades sanctions by the size of the damage to data subjects, the economic benefit obtained, repeat offending, resistance or obstruction of the investigation, failure to follow SIC orders, and acknowledgement of the infringement.

What it means for AI agents and non-human identities

Nothing in Law 1581 is written for machines, but its duties land on them as soon as an agent, workload or integration touches a database of personal data.

• Purpose binding through access: an AI agent with a broad API key can query data for purposes the data subject never authorised. Scope agent credentials to the purposes recorded in the policy and registered in the RNBD. See the Agentic AI Identity Guide.
• Leaked credentials are incidents: an exposed service account password or token that reaches a personal data store is a violation of security codes in the Art. 17(n) sense once misuse is likely, and starts the 15 business day clock. See the Secrets Management Guide.
• Agents as processors: a third-party AI service that processes personal data for you is an encargado. It needs an Art. 25 contract, and a new processor is an RNBD substantial change.
• Training data is not automatically public: Circular 002 of 2024 states that information found online is not public data merely because it is accessible; scraping personal data into models still needs authorisation.
• Audit trails: the auditable-security expectation means logging which identity, human or machine, accessed which database and why. See the AI Agent Audit Trails for Regulators Guide.

Compliance steps

1. Confirm applicability (weeks 1 to 2): list processing in Colombia and Colombian entities, check total assets against 100,000 UVT for the current year, and note which databases fall under Law 1266 instead.
2. Inventory databases (weeks 2 to 6): build one record per database with purpose, data categories, sensitive data, processors, transfers, security measures and the owning identity accounts, human and machine. The Data Mapping and ROPA Guide gives the structure; the RNBD fields map to it.
3. Fix the consent and notice layer (weeks 4 to 10): publish the Art. 13 policy in Spanish, deploy privacy notices at each collection point, and store proof of authorisation in a queryable form.
4. Register and calendar (weeks 6 to 10): register in the RNBD, then put the monthly substantial-change window, the 31 March annual update and the February and August claims reports in the compliance calendar with named owners.
5. Wire incident reporting (weeks 6 to 12): add a Colombia branch to the incident runbook with the 15 business day RNBD report, a Spanish template, and a decision log for data subject notification. Test it in a tabletop that starts from a leaked API key. See the Incident Response Guide.
6. Paper the transfers (weeks 8 to 14): classify each flow as transfer or transmission, check destinations against the SIC list, use Art. 25 contracts for processors, and request a declaración de conformidad where no exception applies.
7. Build accountability evidence (ongoing): assign a person or area for data protection requests (Decree 1377 Art. 23), train staff, run impact assessments for high-risk AI, and keep the evidence in one place so it can be produced on SIC request.

Rollback and testing: pilot new consent flows in one channel, confirm proof of authorisation is captured, then extend; archive old notice models (Decree 1377 Art. 15) so you can show what each data subject saw.

Small versus large organisations

A small enterprise below the UVT threshold skips RNBD registration but still needs a policy, consent records, security and a request channel, and should still treat the incident report to the SIC as required. A large group should name one Colombian RNBD owner, trigger substantial-change reports from change management, and replace GDPR legitimate interests assumptions with consent or an Art. 10 exception.

Measuring it

• Registration coverage: percentage of inventoried databases registered in the RNBD (target 100%).
• Change latency: share of substantial changes reported within the first 10 business days of the following month.
• Incident reporting time: median business days from detection to RNBD report, against the 15 day limit.
• Request timeliness: percentage of consultas answered in 10 business days and reclamos in 15.
• Machine credential scope: percentage of service accounts and agent credentials on personal data stores with a documented purpose and owner.

Common failure patterns

• Relying on legitimate interests: global templates built for GDPR assume a basis that Law 1581 does not offer, leaving security analytics, fraud scoring or monitoring without authorisation or an Art. 10 exception.
• Registering once and forgetting: a new processor or new cloud region is a substantial change, and stale RNBD entries undermine the accountability defence.
• Confusing the incident clock: teams wait for a full forensic picture, when the 15 business day clock runs from detection.
• Transfers by assumption: sending data to an affiliate controller abroad on a processor contract, when a controller-to-controller transfer needs adequacy, an exception or a declaration of conformity.
• Ignoring machine access: a database inventory that lists human roles but not the integrations, service accounts and agents with standing read access. The API Key Management Guide covers the controls.

Practitioner checklist

• Confirm Law 1581 applicability and check assets against 100,000 UVT for the current year.
• Maintain one inventory per database including processors, transfers and machine identities with access.
• Publish an Art. 13 processing policy in Spanish and deploy privacy notices at each collection point.
• Store retrievable proof of authorisation, with explicit consent for sensitive and biometric data.
• Register databases in the RNBD and calendar monthly changes, the annual update and semester claims reports.
• Embed the 15 business day SIC incident report in the runbook, with a Spanish template.
• Classify each data flow as transfer or transmission and document the Art. 26 route or Art. 25 contract.
• Run documented impact assessments before high-risk AI processing, following Circular 002 of 2024.
• Scope, rotate and log service accounts, API keys and agent credentials that reach personal data.

Standards and references

• Secretaría del Senado: Ley Estatutaria 1581 de 2012
• Alcaldía de Bogotá: Decreto 1377 de 2013
• Ministerio de Comercio, Industria y Turismo: Decreto 090 de 2018 (published copy)
• Superintendencia de Industria y Comercio: Circular Externa on implementation of the RNBD
• Superintendencia de Industria y Comercio: Circular Externa 002 de 2024 on personal data in AI systems
• Holland & Knight: Nuevos requisitos para el Registro Nacional de Bases de Datos en Colombia
• Holland & Knight: Cambios en la transferencia de datos personales a otros países
• NIST: Cybersecurity Framework 2.0

This guide summarises Colombia's Law 1581 of 2012, its implementing decrees and SIC instructions as of October 2026 and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Brazil LGPD Guide · Chile Data Protection Law Guide · Mexico Data Protection Law Guide · International Data Transfers Map