Colombia Data Protection & Privacy Regulation

Other Developments

The national data-protection authority has a draft resolution, published for comment on 27 May 2026, that would amend Título V of its Circular Única to set firm deadlines for resolving identity-theft (suplantación) complaints: fifteen business days, extendable by a further eight, with a positive-silence rule under which an unresolved claim at the deadline results in deletion of the disputed negative data record. The same draft is reported, in secondary commentary not yet checked against the regulator's own published list, to expand the number of countries recognised as having an adequate level of data protection for international transfers by five further countries. Both elements remain at the consultation stage and have not been finalised.

Cross-Monitor Connections

No cross-monitor overlap was flagged against this material this period.

Outlook

The period running up to 19 November 2026 is the one to watch: that is when Ley 2573's general regime is expected to take effect, and when implementing regulation from the financial, telecommunications and data-protection authorities is due to follow. Whether the draft Título V resolution on suplantación response windows and adequacy-list expansion is finalised in the same window, and with what effective terms, will determine whether Colombia's cross-border transfer rules and identity-theft redress timelines tighten in practice or remain proposals into the next period.

2 earlier updates not shown here.

Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Colombia's national government filed a new statutory-law bill in August 2025 proposing to update Law 1581 of 2012, the country's foundational personal-data-processing statute, citing the need to adapt the framework to artificial-intelligence and e-commerce developments that the original 2012 law did not anticipate. The bill has reportedly secured House Committee approval, though no enactment has been confirmed as of mid-2026, leaving its final content, timeline to Senate passage, and presidential signature all still open questions. This is nonetheless the most significant structural development in Colombia's omnibus data-protection framework since Law 1581's original enactment: the statute has operated for over a decade under the supervisory authority of the Superintendencia de Industria y Comercio, which is Colombia's designated data protection authority and is empowered to sanction non-compliance with Law 1581, and this cycle marks the first material legislative movement toward revising that foundational framework rather than layering further sub-statutory guidance on top of it.

The reform's stated AI and e-commerce rationale is itself notable: it suggests the eventual amendment, if enacted, may address processing contexts, such as automated decision-making, algorithmic profiling and platform-based commercial data flows, that the current statute handles only through general principles rather than dedicated provisions. Because the bill remains at the proposed stage, none of its specific substantive content can yet be treated as settled; what is established this cycle is the fact and direction of the reform effort, not its eventual text.

Other Developments

SIC enforcement powers and rising fiscalization intensity. The Superintendencia de Industria y Comercio may impose fines of up to 2,000 SMLMV for violations of Law 1581 of 2012, a substantial statutory ceiling that gives the regulator considerable room to scale penalties to the severity of a given violation. Layered on top of that structural authority, 2026 public reporting indicates that SIC-imposed fines for personal-data non-compliance now exceed 100 billion Colombian pesos annually, with reporting suggesting active fiscalization particularly around AI-driven automated decisions. This fine-volume figure rests on single-source secondary reporting rather than confirmed primary SIC disclosure, and has not been independently corroborated at a higher source tier this cycle, so it should be read as an indicative rather than a confirmed measure of enforcement scale. Even with that caveat, a reported annual fine volume of this magnitude, combined with a statutory ceiling as high as 2,000 SMLMV per violation, is consistent with a materially more assertive enforcement posture than a stable, low-activity baseline would produce.

The pairing of active statutory reform with rising reported enforcement intensity is itself a notable structural signal: Colombia's data-protection regime appears to be tightening on two fronts simultaneously, at the legislative level through the Law 1581 modernization bill and at the supervisory level through SIC's fiscalization activity, rather than one front moving while the other remains static.

Cross-Monitor Connections

The reform trajectory described here, in which Colombia's core data-protection statute is being revised partly to address artificial-intelligence developments, is a natural point of contact for the artificial-intelligence monitor, which should track whether the eventual Law 1581 amendment introduces AI-specific processing or automated-decision-making provisions rather than leaving those questions to SIC guidance and enforcement discretion alone. The rising SIC enforcement intensity specifically around AI-driven automated decisions is likewise a signal the artificial-intelligence monitor should be aware of; this brief documents the enforcement-volume signal but does not itself analyze the AI-governance substance of that enforcement activity, which belongs to the artificial-intelligence monitor's remit rather than data-protection's own.

Outlook

The marker to watch over the coming cycles is whether the Law 1581 reform bill advances from its reported House Committee approval toward Senate passage and presidential signature; the current evidence base establishes neither a confirmed enactment timeline nor the bill's precise current floor status as of mid-2026, and that gap should be treated as a tracking priority rather than an assumption of near-term resolution in either direction. On the enforcement side, if the reported fine-volume trend is corroborated by additional primary-source reporting in a subsequent cycle, that would support reading 2026 as a genuine inflection point in SIC's fiscalization intensity rather than a single-source reporting artifact; until then, the figure should be treated as directional. Together, the legislative and enforcement threads point toward a Colombian data-protection environment that is becoming more active on both fronts, with the ultimate shape of the regime depending heavily on what the Law 1581 amendment, if and when enacted, actually contains.

Outlook

The two markers to track are whether the Law 1581 reform bill advances to Senate passage and presidential signature, and whether the reported enforcement fine-volume trend is corroborated by additional primary-source reporting in a subsequent cycle.