--- title: "Colombia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/colombia/ source_html: /jurisdictions/colombia/index.html description: "Colombia data protection and privacy regulation: 10 categories, 53 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-07T14:58:19Z content_sha256: dfe60b32a8f6ad53a43d1b12aa5a6890efef1e141184086e8229d31836c60d61 generator: "fe-fleet/md-twin@1.0" --- # Colombia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/colombia/), [World Payments](https://payments.gi/jurisdictions/colombia/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 53 claims · 34 sources in the cumulative register Download report (PDF) Expand all Colombia's national government filed a new statutory-law bill in August 2025 proposing to update Law 1581 of 2012, the country's foundational personal-data-processing statute, citing the need to adapt the framework to artificial-intelligence and e-commerce developments that the original 2012 law did not anticipate. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Data Subject Rights, AdTech & Commercial Privacy (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=COLOMBIA)[Build Report](/reports/?j=COLOMBIA)[Compare](/compare/?j=COLOMBIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Superintendencia de Industria y Comercio (SIC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 0 Red categories 57 Sub-modules 53 Claims 3 Tier-1 sources Traffic-light mix 3 green 7 amber (sums to 10 rendered categories; click to filter) No red categories; 26 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,064 Full executive summary 146 ###### Latest update · 4 November 2026 #### Lead Signal Colombia's data-protection framework is approaching a scheduled shift in its identity-theft and habeas-data protections. Ley Estatutaria 2573 de 2026, promulgated on 19 May 2026, carries a six-month period before its general regime takes effect, placing commencement around 19 November 2026, with implementing regulation expected from the financial, telecommunications and data-protection regulators by roughly the same date. The specific calendar dates come from compliance-industry commentary rather than the official gazette text itself, so the precise commencement date should be treated as indicative pending confirmation against the primary publication. #### Other Developments The national data-protection authority has a draft resolution, published for comment on 27 May 2026, that would amend Título V of its Circular Única to set firm deadlines for resolving identity-theft (suplantación) complaints: fifteen business days, extendable by a further eight, with a positive-silence rule under which an unresolved claim at the deadline results in deletion of the disputed negative data record. The same draft is reported, in secondary commentary not yet checked against the regulator's own published list, to expand the number of countries recognised as having an adequate level of data protection for international transfers by five further countries. Both elements remain at the consultation stage and have not been finalised. #### Cross-Monitor Connections No cross-monitor overlap was flagged against this material this period. #### Outlook The period running up to 19 November 2026 is the one to watch: that is when Ley 2573's general regime is expected to take effect, and when implementing regulation from the financial, telecommunications and data-protection authorities is due to follow. Whether the draft Título V resolution on suplantación response windows and adequacy-list expansion is finalised in the same window, and with what effective terms, will determine whether Colombia's cross-border transfer rules and identity-theft redress timelines tighten in practice or remain proposals into the next period. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Colombia's national government filed a new statutory-law bill in August 2025 proposing to update Law 1581 of 2012, the country's foundational personal-data-processing statute, citing the need to adapt the framework to artificial-intelligence and e-commerce developments that the original 2012 law did not anticipate. The bill has reportedly secured House Committee approval, though no enactment has been confirmed as of mid-2026, leaving its final content, timeline to Senate passage, and presidential signature all still open questions. This is nonetheless the most significant structural development in Colombia's omnibus data-protection framework since Law 1581's original enactment: the statute has operated for over a decade under the supervisory authority of the Superintendencia de Industria y Comercio, which is Colombia's designated data protection authority and is empowered to sanction non-compliance with Law 1581, and this cycle marks the first material legislative movement toward revising that foundational framework rather than layering further sub-statutory guidance on top of it. The reform's stated AI and e-commerce rationale is itself notable: it suggests the eventual amendment, if enacted, may address processing contexts, such as automated decision-making, algorithmic profiling and platform-based commercial data flows, that the current statute handles only through general principles rather than dedicated provisions. Because the bill remains at the proposed stage, none of its specific substantive content can yet be treated as settled; what is established this cycle is the fact and direction of the reform effort, not its eventual text. #### Other Developments SIC enforcement powers and rising fiscalization intensity. The Superintendencia de Industria y Comercio may impose fines of up to 2,000 SMLMV for violations of Law 1581 of 2012, a substantial statutory ceiling that gives the regulator considerable room to scale penalties to the severity of a given violation. Layered on top of that structural authority, 2026 public reporting indicates that SIC-imposed fines for personal-data non-compliance now exceed 100 billion Colombian pesos annually, with reporting suggesting active fiscalization particularly around AI-driven automated decisions. This fine-volume figure rests on single-source secondary reporting rather than confirmed primary SIC disclosure, and has not been independently corroborated at a higher source tier this cycle, so it should be read as an indicative rather than a confirmed measure of enforcement scale. Even with that caveat, a reported annual fine volume of this magnitude, combined with a statutory ceiling as high as 2,000 SMLMV per violation, is consistent with a materially more assertive enforcement posture than a stable, low-activity baseline would produce. The pairing of active statutory reform with rising reported enforcement intensity is itself a notable structural signal: Colombia's data-protection regime appears to be tightening on two fronts simultaneously, at the legislative level through the Law 1581 modernization bill and at the supervisory level through SIC's fiscalization activity, rather than one front moving while the other remains static. #### Cross-Monitor Connections The reform trajectory described here, in which Colombia's core data-protection statute is being revised partly to address artificial-intelligence developments, is a natural point of contact for the artificial-intelligence monitor, which should track whether the eventual Law 1581 amendment introduces AI-specific processing or automated-decision-making provisions rather than leaving those questions to SIC guidance and enforcement discretion alone. The rising SIC enforcement intensity specifically around AI-driven automated decisions is likewise a signal the artificial-intelligence monitor should be aware of; this brief documents the enforcement-volume signal but does not itself analyze the AI-governance substance of that enforcement activity, which belongs to the artificial-intelligence monitor's remit rather than data-protection's own. #### Outlook The marker to watch over the coming cycles is whether the Law 1581 reform bill advances from its reported House Committee approval toward Senate passage and presidential signature; the current evidence base establishes neither a confirmed enactment timeline nor the bill's precise current floor status as of mid-2026, and that gap should be treated as a tracking priority rather than an assumption of near-term resolution in either direction. On the enforcement side, if the reported fine-volume trend is corroborated by additional primary-source reporting in a subsequent cycle, that would support reading 2026 as a genuine inflection point in SIC's fiscalization intensity rather than a single-source reporting artifact; until then, the figure should be treated as directional. Together, the legislative and enforcement threads point toward a Colombian data-protection environment that is becoming more active on both fronts, with the ultimate shape of the regime depending heavily on what the Law 1581 amendment, if and when enacted, actually contains. Read full brief · 1064 words Standing brief, as of 25 August 2026. #### Regulatory Status Colombia's active statutory reform of Law 1581 combined with rising SIC enforcement intensity signals a materially evolving data-protection posture this cycle. The national government filed a bill in August 2025 to modernize Law 1581 of 2012 for AI and e-commerce developments, reportedly securing House Committee approval without confirmed enactment as of mid-2026. In parallel, the Superintendencia de Industria y Comercio, Colombia's data protection authority, may impose fines of up to 2,000 SMLMV for Law 1581 violations, and 2026 public reporting indicates SIC-imposed fines for personal-data non-compliance now exceed 100 billion Colombian pesos annually, with particular attention to AI-driven automated decisions. #### Outlook The two markers to track are whether the Law 1581 reform bill advances to Senate passage and presidential signature, and whether the reported enforcement fine-volume trend is corroborated by additional primary-source reporting in a subsequent cycle. Read full brief · 146 words Key regulatory facts for Colombia Regulatory Dimension Colombia Standing Position Jurisdiction Colombia (CO) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 53 sourced findings) Regulator & Framework Comprehensive statutory framework in force with an active, sanctioning regulator and constitutional backstop. Lawful Processing & Special Data Core consent/special-category rules are well documented; pseudonymisation/anonymisation standards are not clearly codified. Data Subject Rights Core access/rectification/erasure rights are confirmed; response-window specifics and portability are not clearly codified in the sources reviewed. Controller/Processor Duties Accountability, security, breach-notification and retention duties are well evidenced through statute, decree and enforcement action; joint-controller-specific rules are less clearly codified. Primary Instruments Cited IAPP, DataGuidance, Funcion Publica (official gazette/normative manager), RuleX, Presidencia de la República de Colombia Last Confirmed / Updated 2026-11-04 (34 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Colombia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾ Comprehensive statutory framework in force with an active, sanctioning regulator and constitutional backstop. Primary framework Statutory Law 1581 of 2012 (Data Protection Law), supplemented by Decree 1377 of 2013 and Statutory Law 1266 of 2008 (credit reporting habeas data) Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Green Comprehensive statutory framework in force with an active, sanctioning regulator and constitutional backstop. #### Sub-modules (5) #### Regulator And AuthorityGreen SIC is institutionally housed within the Ministry of Industry, Trade and Tourism yet Law 1581 vests it with independent sanctioning and inspection powers. Claims (3): - Although the SIC is integrated within the structure of the Ministry of Industry, Trade and Tourism, Law 1581 provides it with the power to impose sanctions and other powers necessary for compliance with the law's objectives. - Superintendencia de Industria y Comercio (SIC) — The SIC is Colombia's data protection authority, empowered to sanction non-compliance with Law 1581 of 2012. - Superintendencia de Industria y Comercio (SIC) — The SIC's Delegatura para la Proteccion de Datos Personales exercises Colombia's national data-protection supervisory authority under Ley 1581 de 2012, operating as a specialised division within the SIC rather than as an independent stand-alone DPA #### Act And InstrumentsGreen Two parallel statutes (1266/2008 and 1581/2012) form a common legal regime for personal data protection. Claims (5): - Colombia has two data protection statutes — Law 1266 of 2008 (credit reporting) and Law 1581 of 2012 (general personal data protection) — which together constitute a common legal regime. - Ley Estatutaria 2573 de 2026, promulgated 19-20 May 2026, develops habeas data, privacy and good-name rights specifically to protect identity-theft victims against negative credit reports and undue debt collection, applying to telecom operators, financial/credit entities, commercial establishments and information operators - Colombia Law 1581 reform bill (August 2025) — The Colombian national government filed a new statutory-law bill in August 2025 to update Law 1581 of 2012's personal-data-processing rules, citing the need to adapt to AI and e-commerce developments; House Committee approval reported without enactment as of mid-2026. - Superintendencia de Industria y Comercio (SIC) — The SIC opened a public consultation (announced 2 Oct 2026, closing 9 Oct 2026) under Ley 2573 de 2026 seeking technical and legal input to build guidelines, recommendations and protocols on identity validation and personal-data processing - Ley 2573 de 2026's general regime, per Art. 13, takes effect six months after its 19 May 2026 promulgation, placing commencement around 19 November 2026. #### Material ScopeGreen The constitutional habeas data action operates as a directly enforceable fundamental right independent of statutory processes. Claims (1): - The Colombian Constitution provides a special judicial remedy for data protection known as 'habeas data,' a fundamental and directly applicable right before any judge. #### Territorial ScopeAmber Historical reporting (2018) indicated a draft bill to extend SIC's investigative jurisdiction over foreign-headquartered controllers; current legislative status of that specific proposal could not be confirmed in this research pass. Claims (1): - As of 2018 reporting, a draft bill existed to give the SIC power to investigate companies headquartered outside Colombia (e.g., Facebook, Google), though current passage status is unconfirmed. #### Regulator Registration And FilingGreen Controllers/processors above defined asset thresholds must register databases in the National Database Registry (RNBD); SMEs and natural persons are exempted since Decree 90/2018. Claims (1): - Natural persons and SMEs are exempt from RNBD registration, while public legal entities and companies/non-profits with assets above 100,000 UVT must register their databases within established deadlines. #### Key findings (3) - Dual-statute (1581/1266) regime under SIC; territorial scope corrected this cycle to reflect current extraterritorial enforcement practice and pending 2025 bills. — source on file - Dual-statute (1581/1266) regime under SIC; territorial scope corrected this cycle to reflect current extraterritorial enforcement practice and pending 2025 bills. — source on file - Dual-statute (1581/1266) regime under SIC; territorial scope corrected this cycle to reflect current extraterritorial enforcement practice and pending 2025 bills. — source on file Colombia operates a dual-statute omnibus regime: Statutory Law 1581 of 2012 (general personal data protection) and Statutory Law 1266 of 2008 (habeas data financiero / credit reporting), both enforced by the Superintendencia de Industria y Comercio (SIC), which sits administratively inside the Ministry of Industry, Trade and Tourism but holds independent sanctioning powers. The constitutional 'habeas data' remedy provides a directly judicially enforceable data-protection right supplementing the statutory regime. Periodic update · new data 2026-11-04 #### Regulator & Framework Ley Estatutaria 2573 de 2026 was promulgated on 19 May 2026 and carries a six-month vacatio legis before its general regime takes effect, placing commencement around 19 November 2026. Implementing regulation from the financial regulator, the telecommunications regulator and the data-protection regulator is expected by roughly the same date. These specific calendar markers are drawn from compliance-industry commentary rather than verified against the Diario Oficial text itself, so the precise date of general effect should be treated as indicative. #### Outlook The period around 19 November 2026 is the point at which the general regime, and any implementing regulation issued alongside it, will show whether the law's identity-theft and habeas-data protections for the banking and telecommunications sectors take practical effect on the schedule reported, or slip. 1 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Regulator & Framework Colombia's data-protection supervisory authority remains the Delegatura para la Proteccion de Datos Personales, a specialised division within the Superintendencia de Industria y Comercio (SIC) operating under Ley 1581 de 2012, rather than an independent stand-alone data-protection authority. The principal development this cycle is Ley Estatutaria 2573 de 2026, promulgated 19-20 May 2026, which develops habeas data, privacy and good-name rights specifically to protect identity-theft victims against negative credit reports and undue debt collection. The law applies to telecom operators, financial and credit entities, commercial establishments and information operators, extending Colombia's data-protection framework into a targeted identity-validation regime layered on top of the existing general habeas data structure. Following the law's promulgation, the SIC opened a public consultation, announced 2 October 2026 and closing 9 October 2026, seeking technical and legal input to build guidelines, recommendations and protocols on identity validation and personal-data processing under the new statute. This consultation signals that the practical implementing detail of Ley 2573 de 2026, including how identity-validation protocols will operate in practice, remains to be settled through SIC guidance rather than through the statute's text alone. The governance structure of Colombia's data-protection regime, a sub-regulator functioning within a broader competition and consumer-protection authority, is not itself altered by either development. #### Outlook The SIC's implementing protocol following its closed consultation is expected in the fourth quarter of 2026. That protocol will be the next concrete indicator of how identity-validation duties under Ley 2573 de 2026 translate into operational requirements for the telecom, financial, credit and information-operator sectors the law targets. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (11) - [IAPP](https://iapp.org/news/a/obtaining-adequacy-standing-for-colombia) — Although the SIC is integrated within the structure of the Ministry of Industry, Trade and Tourism, Law 1581 provides it with the power to impose sanctions and other powers necessary for compliance with the law's objectives. - [IAPP](https://iapp.org/news/a/obtaining-adequacy-standing-for-colombia) — Colombia has two data protection statutes — Law 1266 of 2008 (credit reporting) and Law 1581 of 2012 (general personal data protection) — which together constitute a common legal regime. - [IAPP](https://iapp.org/news/a/obtaining-adequacy-standing-for-colombia) — The Colombian Constitution provides a special judicial remedy for data protection known as 'habeas data,' a fundamental and directly applicable right before any judge. - [DataGuidance](https://corporate.dataguidance.com/colombia-database-registration-amendments-put-end-complex-expensive-obligations-smes/) — As of 2018 reporting, a draft bill existed to give the SIC power to investigate companies headquartered outside Colombia (e.g., Facebook, Google), though current passage status is unconfirmed. - [DataGuidance](https://corporate.dataguidance.com/colombia-database-registration-amendments-put-end-complex-expensive-obligations-smes/) — Natural persons and SMEs are exempt from RNBD registration, while public legal entities and companies/non-profits with assets above 100,000 UVT must register their databases within established deadlines. - [Funcion Publica (official gazette/normative manager)](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=277136) — Ley Estatutaria 2573 de 2026, promulgated 19-20 May 2026, develops habeas data, privacy and good-name rights specifically to protect identity-theft victims against negative credit reports and undue debt collection, applying to telecom operators, financial/credit entities, commercial establishments and information operators - [RuleX](https://rulex.org/blog/habeas-data-ley-1581-colombia-2026-guia-empresas) — Superintendencia de Industria y Comercio (SIC) — The SIC is Colombia's data protection authority, empowered to sanction non-compliance with Law 1581 of 2012. - [Presidencia de la República de Colombia](https://www.presidencia.gov.co/prensa/Paginas/Gobierno-radico-proyecto-de-ley-para-actualizar-normas-sobre-proteccion-250828.aspx) — Colombia Law 1581 reform bill (August 2025) — The Colombian national government filed a new statutory-law bill in August 2025 to update Law 1581 of 2012's personal-data-processing rules, citing the need to adapt to AI and e-commerce developments; House Committee approval reported without enactment as of mid-2026. - [Pirani Risk](https://www.piranirisk.com/es/hub-regulatorio/ley-2573-2026-suplantacion-identidad-bancos-telcos-colombia) — Superintendencia de Industria y Comercio (SIC) — The SIC's Delegatura para la Proteccion de Datos Personales exercises Colombia's national data-protection supervisory authority under Ley 1581 de 2012, operating as a specialised division within the SIC rather than as an independent stand-alone DPA - [Universidad Externado - Observatorio de Nuevas Tecnologias](https://privatech.uexternado.edu.co/consulta-publica-de-la-sic-para-fortalecer-la-validacion-de-identidad-y-la-proteccion-de-datos-personales-en-colombia/) — Superintendencia de Industria y Comercio (SIC) — The SIC opened a public consultation (announced 2 Oct 2026, closing 9 Oct 2026) under Ley 2573 de 2026 seeking technical and legal input to build guidelines, recommendations and protocols on identity validation and personal-data processing - [Pirani Risk](https://www.piranirisk.com/es/hub-regulatorio/ley-2573-2026-suplantacion-identidad-bancos-telcos-colombia) — Ley 2573 de 2026's general regime, per Art. 13, takes effect six months after its 19 May 2026 promulgation, placing commencement around 19 November 2026. ### Colombia: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent/special-category rules are well documented; pseudonymisation/anonymisation standards are not clearly codified. Primary framework Statutory Law 1581 of 2012; Decree 1377 of 2013 Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Amber Core consent/special-category rules are well documented; pseudonymisation/anonymisation standards are not clearly codified. D2 · Lawful Processing — Full Module Record 4 sub-modules · 46 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Colombia: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core access/rectification/erasure rights are confirmed; response-window specifics and portability are not clearly codified in the sources reviewed. Primary framework Statutory Law 1581 of 2012; Decree 1377 of 2013 Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Amber Core access/rectification/erasure rights are confirmed; response-window specifics and portability are not clearly codified in the sources reviewed. #### Sub-modules (5) #### Access RightGreen Law 1581 provides for access rights for data subjects. Claims (1): - Law 1581 contains provisions relating to the rights of data subjects, such as access, rectification, update and deletion, and the corresponding obligations of controllers and processors. #### Rectification And ErasureGreen Rectification, update and deletion rights are provided alongside access. Claims (1): - Law 1581 contains provisions relating to the rights of data subjects, such as access, rectification, update and deletion, and the corresponding obligations of controllers and processors. #### Restriction And ObjectionRed No dedicated restriction-of-processing or objection right distinct from rectification/erasure was identified. #### Data PortabilityRed No express statutory data-portability right was identified. #### Deadlines And Response WindowsAmber Decree 1377 Article 27 requires controllers to adopt a process for addressing and responding to data-subject queries, requests and claims, though a specific statutory day-count deadline was not confirmed in sources reviewed. Claims (3): - Article 27 of Decree 1377/2013 requires the adoption of a process for addressing and responding to queries, requests and claims by data subjects regarding any aspect of treatment. - Colombian controllers (habeas data response windows) — Colombian controllers must respond to habeas data consultations within ten business days and to claims within fifteen business days, extendable by a further eight days when justified. - SIC's draft resolution would set a 15-business-day (extendable by 8) response window for suplantación claims, with deemed-removal on missed deadline. #### Key findings (3) - Access/rectification/erasure confirmed; portability and distinct restriction/objection unconfirmed. — source on file - Access/rectification/erasure confirmed; portability and distinct restriction/objection unconfirmed. — source on file - Access/rectification/erasure confirmed; portability and distinct restriction/objection unconfirmed. — source on file Law 1581 enumerates access, rectification, update and deletion rights, and Decree 1377 requires controllers to maintain a process for responding to data-subject queries and claims. No explicit statutory deadline analogous to GDPR's 30-day window, nor a distinct data-portability right, was confirmed in the sources reviewed. No periodic updates recorded in this cycle Sources and claims (4) - [IAPP](https://iapp.org/news/a/obtaining-adequacy-standing-for-colombia) — Law 1581 contains provisions relating to the rights of data subjects, such as access, rectification, update and deletion, and the corresponding obligations of controllers and processors. - [IAPP](https://iapp.org/news/a/colombia-is-a-data-protection-officer-required-for-compliance) — Article 27 of Decree 1377/2013 requires the adoption of a process for addressing and responding to queries, requests and claims by data subjects regarding any aspect of treatment. - [RuleX](https://rulex.org/blog/habeas-data-ley-1581-colombia-2026-guia-empresas) — Colombian controllers (habeas data response windows) — Colombian controllers must respond to habeas data consultations within ten business days and to claims within fifteen business days, extendable by a further eight days when justified. - [CER Latam](https://www.cerlatam.com/normatividad/sic-proyecto-de-resolucion-27-may-2026/) — SIC's draft resolution would set a 15-business-day (extendable by 8) response window for suplantación claims, with deemed-removal on missed deadline. ### Colombia: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Accountability, security, breach-notification and retention duties are well evidenced through statute, decree and enforcement action; joint-controller-specific rules are less clearly codified. Primary framework Statutory Law 1581 of 2012; Decree 1377 of 2013 Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Green Accountability, security, breach-notification and retention duties are well evidenced through statute, decree and enforcement action; joint-controller-specific rules are less clearly codified. D4 · Controller & Processor — Full Module Record 7 sub-modules · 65 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Colombia: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer mechanisms and SIC-granted adequacy are well documented; EU-adequacy status is unresolved/stalled and data-localisation rules were not identified. Primary framework Statutory Law 1581 of 2012, Article 26; Circular Externa No. 003 of 2025 Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Amber Transfer mechanisms and SIC-granted adequacy are well documented; EU-adequacy status is unresolved/stalled and data-localisation rules were not identified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 108 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Colombia: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial/credit-reporting overlay is well evidenced; other sectoral overlays are not confirmed in sources reviewed. Primary framework Statutory Law 1266 of 2008 (habeas data financiero) Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Amber Financial/credit-reporting overlay is well evidenced; other sectoral overlays are not confirmed in sources reviewed. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 49 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Colombia: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct-marketing consent enforcement is confirmed; adtech-specific sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) show no comprehensive regime in sources reviewed. Primary framework Statutory Law 1581 of 2012 Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Amber Direct-marketing consent enforcement is confirmed; adtech-specific sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) show no comprehensive regime in sources reviewed. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 41 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Colombia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric classification is confirmed and in force; AI governance is at the proposed-legislation stage; profiling/ADM/genetic/surveillance sub-modules lack confirmed coverage. Primary framework Decree 1377 of 2013 (biometric data); AI Bill (Congress, pending, as of research date) Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Amber Biometric classification is confirmed and in force; AI governance is at the proposed-legislation stage; profiling/ADM/genetic/surveillance sub-modules lack confirmed coverage. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The SIC, by Resolucion 45710 of 18 June 2026, finally confirmed the immediate and definitive closure of the biometric data-processing operation run in Colombia by World Foundation and Tools for Humanity Corporation. The companies' appeal against the SIC's original sanction was resolved by this resolution, meaning the closure is now final with no further appeal available. The underlying conduct that triggered the sanction was the collection of sensitive biometric data, specifically iris images, via the companies' Orb devices, in exchange for payment to individuals, without what the SIC determined to be adequate authorisation for processing this category of sensitive personal data. This is the most significant confirmed biometric-governance enforcement outcome identified for Colombia this cycle, and it establishes a clear marker of the SIC's posture toward large-scale biometric data collection conducted by technology platforms, particularly where collection is incentivised through direct payment to data subjects. The closure sanction, immediate and definitive, represents the most severe enforcement tool available to the SIC short of criminal referral, underscoring the seriousness with which the authority treated the absence of adequate authorisation for the iris-image processing at issue. #### Outlook With the World Foundation and Tools for Humanity closure now final, the next point of interest for this module is whether the SIC's reasoning in Resolucion 45710 produces broader guidance applicable to other biometric-data-processing operators in Colombia, particularly any that similarly incentivise data collection through direct payment to individuals. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 67 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Colombia: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Children's-data special-category treatment is confirmed; age-verification, minor-profiling-ban, education-setting and dependent-adult sub-modules lack confirmed coverage. Primary framework Decree 1377 of 2013 Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Amber Children's-data special-category treatment is confirmed; age-verification, minor-profiling-ban, education-setting and dependent-adult sub-modules lack confirmed coverage. D9 · Children's Privacy — Full Module Record 5 sub-modules · 41 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Colombia: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Regulator powers and enforcement activity are well evidenced with recent (2025-2026) enforcement and rulemaking; collective-redress, private-right-of-action, and regulator-capacity sub-modules lack confirmed coverage. Primary framework Statutory Law 1581 of 2012 Supervisory authority [Superintendencia de Industria y Comercio (SIC)](https://www.sic.gov.co/) Traffic-light rationale — Green Regulator powers and enforcement activity are well evidenced with recent (2025-2026) enforcement and rulemaking; collective-redress, private-right-of-action, and regulator-capacity sub-modules lack confirmed coverage. Periodic update · new data 2026-10-18 #### Enforcement & Redress The SIC's enforcement posture this cycle is defined by the final confirmation, through Resolucion 45710 of 18 June 2026, of the immediate and definitive closure sanction against World Foundation and Tools for Humanity Corporation for unauthorised processing of sensitive biometric data. This resolution resolved the companies' appeal against the original sanction, meaning no further appeal avenue remains available and the closure stands as a completed enforcement action rather than a pending one. The severity of the outcome, a definitive and immediate closure rather than a fine alone, illustrates the upper end of the SIC's sanctioning powers under Colombia's data-protection regime, which separately include fines of up to 2,000 SMMLV per infraction, suspension of processing activities for up to six months, and the power to order temporary or definitive closure of operations for serious or repeated breaches. The World Foundation case appears to represent an exercise of that closure power at its most severe, applied to a case involving sensitive biometric data collected in exchange for payment without adequate authorisation. #### Outlook The confirmed World Foundation closure sets a benchmark for how the SIC approaches enforcement against biometric-data operators going forward. Whether this enforcement intensity extends to other sanctioning tools available to the SIC, including the fine and suspension powers short of definitive closure, in future cases will be the next indicator of the authority's overall enforcement trajectory. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Superintendencia de Industria y Comercio's handling of the World Foundation and Tools for Humanity Corporation matter illustrates the practical reach of its enforcement toolkit under Ley 1581 de 2012. Secondary-source summaries describe that toolkit as including fines of up to 2,000 SMMLV, suspension of data-processing activities for up to six months, and the power to order the definitive closure of an establishment for breaches of the statute, although the precise statutory pinpoint article for that toolkit was not independently verified this cycle. In the World/Worldcoin matter, the SIC applied the uppermost end of that range: rather than a time-limited suspension or a monetary fine, it ordered the immediate and permanent shutdown of the operation and the deletion of all collected iris codes and other biometric data, under Resolucion 45710, a decision that was confirmed on appeal with no further recourse available to the operator. This sits within the 180-day enforcement lookback as the most significant recent enforcement action taken under Colombia's data-protection framework. #### Outlook With the World/Worldcoin order now final and non-appealable, the enforcement and redress question going forward is whether the SIC applies the same severity of remedy, permanent shutdown and mandatory deletion rather than a time-limited suspension or fine, to other operators found to have collected sensitive personal data without the reinforced consent Ley 1581 de 2012 requires. This decision stands as the clearest available benchmark for the upper bound of SIC enforcement action currently in effect. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 103 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties