Page 1

STATUTORY LAW 1581 OF 2012
(October 17)
Partially regulated by National Decree 1377 of 2013.
Whereby general provisions for data protection are issued
personal.
THE CONGRESS OF COLOMBIA
DECREE:
TITLE I
OBJECT, SCOPE OF APPLICATION AND DEFINITIONS
Article 1. Object . The purpose of this law is to develop the right
constitutional law that all people have to know, update and rectify the
information that has been collected about them in databases or files,
and the other rights, freedoms and constitutional guarantees referred to in the
Article 15 of the Political Constitution; as well as the right to information
enshrined in article 20 of the same.
Article 2. Scope of application . The principles and provisions contained
in this law will be applicable to the personal data registered in
any database that makes them susceptible to treatment by entities
of a public or private nature.
This law will apply to the processing of personal data carried out in
Colombian territory or when the Data Controller or Person in Charge of the
Treatment not established in national territory is applicable the legislation
Colombian under international norms and treaties.
The personal data protection regime established herein
law will not apply:
a) To the databases or files maintained in a scope exclusively
personal or domestic.
When these databases or files are to be supplied to third parties
The Holder must be previously informed and his authorization requested. In
In this case, the Managers and Managers of the databases and files
will be subject to the provisions contained in this law;
b) To databases and files whose purpose is security and
national defense, as well as the prevention, detection, monitoring and control of
money laundering and terrorist financing;
c) To the databases that have as their purpose and contain information on
intelligence and counterintelligence;

Page 2

d) To databases and archives of journalistic information and other
editorial content;
e) To the databases and files regulated by the Law 1266 of 2008;
f) To the databases and files regulated by the Law 79 of 1993.
Paragraph. The principles on data protection will be applicable to all
databases, including those excepted in this article, with the
limits provided in this law and without conflict with the data that have
characteristics of being protected by the legal reserve. In the event that the
special regulations that regulate excepted databases foresee
principles that take into account the special nature of data, the
They will apply concurrently to those provided for in this law.
Article 3. Definitions . For the purposes of this law, it is understood by:
a) Authorization: Prior, express and informed consent of the Holder to
carry out the Processing of personal data;
b) Database: Organized set of personal data that is the subject of
Treatment;
c) Personal data: Any information linked or that may be associated with
one or more specific or determinable natural persons;
d) Responsible for the Treatment: Natural or legal person, public or private,
that by itself or in association with others, carry out the Data Processing
personal on behalf of the Data Controller;
e) Responsible for the Treatment: Natural or legal person, public or private,
that by itself or in association with others, decides on the database and / or the
Data processing;
f) Owner : Natural person whose personal data is subject to Treatment;
g) Treatment: Any operation or set of operations on data
personal, such as the collection, storage, use, circulation or
suppression.
TITLE II
GUIDING PRINCIPLES
Article 4. Principles for the Processing of personal data. In it
development, interpretation and application of this law, will be applied,
harmoniously and comprehensively, the following principles:
a) Principle of legality regarding data processing: The
Treatment referred to in this law is a regulated activity that must
be subject to what is established in it and in the other provisions that

Page 3

develop;
b) Principle of purpose: The Treatment must obey a purpose
legitimate in accordance with the Constitution and the Law, which must be reported to the
Headline;
c) Principle of freedom: Treatment can only be exercised with the
prior, express and informed consent of the Holder. Personal information
may not be obtained or disclosed without prior authorization, or in the absence of
legal or judicial mandate that relieves consent;
d) Principle of truthfulness or quality: The information subject to Treatment must
be truthful, complete, accurate, up-to-date, verifiable and understandable. I know
prohibits the Processing of partial, incomplete, fractioned data or that
mislead;
e) Principle of transparency: The treatment must guarantee the right
of the Holder to be obtained from the Data Controller or the Person in Charge of
Treatment, at any time and without restrictions, information about the
existence of data concerning you;
f) Principle of access and restricted circulation: Treatment is subject to
the limits derived from the nature of the personal data, the
provisions of this law and the Constitution. In this sense, the
Treatment can only be done by persons authorized by the Holder and / or by
the persons provided for in this law;
Personal data, except public information, may not be available
on the Internet or other means of dissemination or mass communication, unless the
access is technically controllable to provide restricted knowledge
only to the Holders or authorized third parties in accordance with this law;
g) Security principle: The information subject to Treatment by the
Responsible for the Treatment or Person in Charge of the Treatment referred to in the
present law, it must be handled with technical, human and
administrative that are necessary to provide security to the records
avoiding its adulteration, loss, consultation, use or unauthorized access or
fraudulent;
h) Principle of confidentiality: All persons involved in the
Processing of personal data that is not public in nature are
obliged to guarantee the reservation of information, even after
after your relationship with any of the tasks that the Treatment comprises,
being able only to supply or communicate personal data when
this corresponds to the development of the activities authorized in this law
and in the terms of it.

Page 4

TITLE III
SPECIAL CATEGORIES OF DATA
Article 5. Sensitive data . For the purposes of this law,
understands by sensitive data those that affect the privacy of the Holder or whose
misuse can lead to discrimination, such as those that reveal
racial or ethnic origin, political orientation, religious convictions or
philosophical, membership in trade unions, social organizations, rights
human rights or that promotes interests of any political party or that
guarantee the rights and guarantees of opposition political parties as well as
data related to health, sexual life and biometric data.
Article 6. Sensitive data processing. Treatment of
sensitive data, except when:
a) The Holder has given his explicit authorization to said Treatment, except in
the cases that by law the granting of said authorization is not required;
b) The Treatment is necessary to safeguard the vital interest of the Holder and
he is physically or legally incapacitated. At these events,
legal representatives must grant their authorization;
c) The Treatment is carried out in the course of legitimate activities and with
the due guarantees by a foundation, NGO, association or any
another non-profit organization, whose purpose is political, philosophical,
religious or trade union, as long as they refer exclusively to its members or
people who maintain regular contact by reason of their purpose. In
these events, the data may not be provided to third parties without authorization
of the Holder;
d) The Treatment refers to data that are necessary for the
recognition, exercise or defense of a right in a judicial process;
e) The Treatment has a historical, statistical or scientific purpose. In this
event, the measures leading to the suppression of identity must be adopted
of the Holders.
Article 7. Rights of children and adolescents. In the treatment
respect for the prevailing rights of children and
teenagers.
The processing of personal data of boys, girls and
adolescents, except for those data that are of a public nature.
It is the task of the State and educational entities of all kinds to provide information
and train legal representatives and guardians on the possible risks to
What children and adolescents face regarding Treatment
improper use of your personal data, and provide knowledge about the use

Page 5

responsible and safe by children and adolescents of their data
personal information, your right to privacy and protection of your personal information
and that of others. The National Government will regulate the matter, within the
six (6) months following the promulgation of this law.
TITLE IV
RIGHTS AND LEGAL CONDITIONS FOR THE TREATMENT OF
DATA
Article 8. Rights of the Holders. The holder of the personal data
you will have the following rights:
a) Know, update and rectify your personal data against
Responsible for the Treatment or Responsible for the Treatment. This right is
may exercise, among others, against partial, inaccurate, incomplete data,
fractioned, misleading, or those whose Treatment is
expressly prohibited or has not been authorized;
b) Request proof of the authorization granted to the Data Controller
except when expressly excepted as a requirement for the Treatment, of
in accordance with the provisions of article 10 of this law;
c) Be informed by the Data Controller or the Person in Charge of the
Treatment, upon request, regarding the use you have given your data
personal;
d) Present before the Superintendency of Industry and Commerce complaints about
infractions of the provisions of this law and the other regulations that the
modify, add or complement;
e) Revoke the authorization and / or request the deletion of the data when in the
Treatment does not respect the principles, rights and constitutional guarantees
and legal. The revocation and / or deletion will proceed when the Superintendency
of Industry and Commerce has determined that in the Treatment the
Responsible or Manager have incurred in conduct contrary to this law and
the Constitution;
f) Free access to your personal data that has been the subject of
Treatment.
Article 9. Holder's authorization. Without prejudice to the exceptions
provided for in the law, the Treatment requires prior authorization and
informed of the Holder, which must be obtained by any means that
may be the subject of subsequent consultation.
Article 10. Cases in which authorization is not necessary. Authorization
of the Holder will not be necessary in the case of:

Page 6

a) Information required by a public or administrative entity in the exercise of
their legal functions or by court order;
b) Data of a public nature;
c) Cases of medical or health emergency;
d) Processing of information authorized by law for historical purposes,
statisticians or scientists;
e) Data related to the Civil Registry of Persons.
Whoever accesses personal data without prior authorization must
in any case, comply with the provisions contained in this law.
Article 11. Provision of information . The information requested may be
supplied by any means, including electronic, as required
the owner. The information must be easy to read, without technical barriers that
prevent their access and must correspond in a whole to the one that rests in
the database.
The National Government will establish the way in which the Responsible for the
Treatment and Treatment Managers must provide the information
of the Holder, taking into account the nature of the personal data, This regulation
must be given no later than one year after the promulgation of the
present law.
Article 12. Duty to inform the Holder. The Data Controller, at
When requesting authorization from the Holder, you must inform them in a
clearly and expresses the following:
a) The Treatment to which your personal data will be submitted and the purpose of the
same;
b) The optional nature of the answer to the questions that are asked,
when these relate to sensitive data or the data of girls,
children and adolescents;
c) The rights that assist you as the Owner;
d) The identification, physical or electronic address and telephone number of the person in charge of the
Treatment.
Paragraph. The Data Controller must keep proof of the
compliance with the provisions of this article and, when the Holder requests it,
give you a copy of this.
Article 13. People to whom the information can be provided .
The information that meets the conditions established in this law may
be supplied to the following persons:

Page 7

a) To the Holders, their successors in title or their legal representatives;
b) To public or administrative entities in the exercise of their functions
legal or by court order;
c) To third parties authorized by the Owner or by law.
TITLE V
PROCEDURES
Article 14. Consultations . The Holders or their successors may consult the
Personal information of the Holder that resides in any database, be it
This is from the public or private sector. The person in charge of the treatment or person in charge
Treatment must provide them with all the information contained in the
individual registration or that is linked to the identification of the Holder.
The query will be made through the means authorized by the person in charge of the
Treatment or Treatment Manager, as long as it is possible
keep proof of this.
The query will be answered within a maximum term of ten (10) business days
counted from the date of receipt. When it is not possible
attend the query within said term, the interested party will be informed,
stating the reasons for the delay and indicating the date on which it will be attended
your inquiry, which in no case may exceed five (5) business days
following the expiration of the first term.
Paragraph. The provisions contained in special laws or regulations
issued by the National Government may establish lower terms,
taking into account the nature of the personal data.
Article 15. Claims . The Holder or his successors in title who consider that the
information contained in a database must be corrected,
update or deletion, or when they notice the alleged breach of
any of the duties contained in this law, may file a claim
before the Person in Charge of Treatment or the Person in Charge of Treatment which
It will be processed under the following rules:
1. The claim will be made through a request addressed to the Responsible for the
Treatment or the Person in Charge of Treatment, with the identification of the Holder, the
description of the facts that give rise to the claim, the address, and
Accompanying the documents that you want to enforce. If the claim is
incomplete, the interested party will be required within five (5) days after
the receipt of the claim to correct the faults. After two (2)
months from the date of the request, without the applicant submitting the
required information, it will be understood that you have withdrawn the claim.
In the event that the person receiving the claim is not competent to resolve it,

Page 8

will transfer to whoever corresponds within a maximum term of two (2) days
and will inform the interested party of the situation.
2. Once the complete claim is received, a
legend that says "claim in process" and the reason for it, in a term not
greater than two (2) business days. Said legend shall be maintained until the
claim is decided.
3. The maximum term to attend the claim will be fifteen (15) business days
counted from the day following the date of receipt. When i won't be
possible to attend the claim within said term, the interested party will be informed
the reasons for the delay and the date on which your claim will be dealt with, which in
no case may exceed eight (8) business days following expiration
of the first term.
Article 16. Procedure requirement. The Holder or successor only
may file a complaint with the Superintendency of Industry and Commerce once
has exhausted the consultation or claim process before the Responsible for the
Treatment or Person in Charge of Treatment.
TITLE VI
DUTIES OF THOSE RESPONSIBLE FOR TREATMENT AND MANAGERS
OF TREATMENT
Article 17. Duties of those Responsible for the Treatment. The
Those responsible for the Treatment must comply with the following duties, without
prejudice to the other provisions set forth in this law and in others that
govern their activity:
a) Guarantee the Holder, at all times, the full and effective exercise of the right
habeas data;
b) Request and keep, under the conditions provided for in this law, a copy of the
the respective authorization granted by the Holder;
c) Properly inform the Holder about the purpose of the collection and the
rights that assist you by virtue of the authorization granted;
d) Keep the information under the necessary security conditions to
prevent their adulteration, loss, consultation, use or unauthorized access or
fraudulent;
e) Guarantee that the information provided to the person in charge of the
Treatment is truthful, complete, exact, updated, verifiable and
understandable;
f) Update the information, communicating in a timely manner to the person in charge of the
Treatment, all the news regarding the data that previously

Page 9

has supplied and adopt the other necessary measures so that the
information provided to it is kept up to date;
g) Rectify the information when it is incorrect and communicate the pertinent to the
Responsible for the Treatment;
h) Provide the Treatment Manager, as the case may be, only data
whose Treatment is previously authorized in accordance with the provisions
in this law;
i) Demand from the Person in Charge of Treatment at all times, respect for the
security and privacy conditions of the Holder's information;
j) Process the queries and claims formulated in the terms indicated in the
present law;
k) Adopt an internal manual of policies and procedures to guarantee the
adequate compliance with this law and especially, for the attention of
inquiries and claims;
l) Inform the Treatment Manager when certain information is
is under discussion by the Holder, once the
claim and the respective procedure has not been completed;
m) Inform at the request of the Holder about the use given to their data;
n) Inform the data protection authority when they are presented
violations of security codes and there are risks in the administration of
the information of the Holders.
o) Comply with the instructions and requirements issued by the Superintendency
of Industry and Commerce.
Article 18. Duties of those in charge of the treatment. The managers
Treatment must comply with the following duties, without prejudice to the
other provisions set forth in this law and in others that govern its
activity:
a) Guarantee the Holder, at all times, the full and effective exercise of the right
habeas data;
b) Keep the information under the security conditions necessary to
prevent their adulteration, loss, consultation, use or unauthorized access or
fraudulent;
c) Make timely update, rectification or deletion of the
data in the terms of this law;
d) Update the information reported by the Data Controllers
within five (5) business days from receipt;

Page 10

e) Process the queries and claims made by the Holders in the
terms indicated in this law;
f) Adopt an internal manual of policies and procedures to guarantee the
adequate compliance with this law and, especially, for the care of
inquiries and claims by the Holders;
g) Register in the database the legend "claim in process" in the form in
that is regulated in the present law;
h) Insert in the database the legend "information in judicial discussion"
once notified by the competent authority on processes
judicial related to the quality of personal data;
i) Refrain from circulating information that is being controversial by the Holder
and whose blocking has been ordered by the Superintendency of Industry and
Trade;
j) Allow access to information only to people who can
have access to it;
k) Inform the Superintendency of Industry and Commerce when they arise
violations of security codes and there are risks in the administration of
the information of the Holders;
l) Comply with the instructions and requirements issued by the Superintendency
of Industry and Commerce.
Paragraph. In the event that the qualities of Responsible for the
Treatment and Treatment Manager in the same person, it will be required
the fulfillment of the duties provided for each one.
TITLE VII
OF THE MONITORING AND SANCTION MECHANISMS
CHAPTER I
From the data protection authority
Article 19. Data Protection Authority . The Superintendency of
Industry and Commerce, through a Delegation for Data Protection
Personal, will exercise vigilance to guarantee that in the Treatment of
personal data the principles, rights, guarantees and
procedures provided for in this law.
Paragraph 1. The National Government within a period of six (6) months from
as of the effective date of this law, it will incorporate within
of the structure of the Superintendency of Industry and Commerce an office
Deputy Superintendent to exercise the functions of Authority of

Page 11

Data Protection.
Paragraph 2. Monitoring the processing of regulated personal data
In the law 1266 of 2008 will be subject to the provisions of said standard.
Article 20. Resources for the exercise of their functions. The
Superintendency of Industry and Commerce will have the following resources
to exercise the functions that are attributed to it by this law:
a) The resources allocated to it in the General Budget of the
Nation.
Article 21. Functions . The Superintendency of Industry and Commerce will exercise
the following functions:
a) Ensure compliance with the legislation on data protection
personal;
b) To carry out the investigations of the case, ex officio or at the request of a party and, as
result of them, order the measures that are necessary to make
effective habeas data right. For the purpose, provided that it is unknown
the right, may provide that access and supply of data be granted,
the rectification, updating or deletion of the same;
c) Provide the temporary blocking of the data when, of the request and of the
evidence provided by the Owner, a certain risk of infringement is identified
of their fundamental rights, and such blocking is necessary to
protect them while a final decision is made;
d) Promote and disseminate the rights of people in relation to the
Processing of personal data and will implement educational campaigns to
train and inform citizens about the exercise and guarantee of the
fundamental right to data protection;
e) Provide instructions on the measures and procedures necessary for the
adequacy of the operations of the Data Controllers and
Responsible for the Treatment to the provisions provided in this law;
f) Request the Treatment Managers and Treatment Managers the
information that is necessary for the effective exercise of their functions.
g) Make declarations of conformity on transfers
international data;
h) Administer the National Public Registry of Databases and issue the
orders and actions necessary for its administration and operation;
i) Suggest or recommend adjustments, corrections or adjustments to the
regulations that are consistent with technological, computer or
communicational;

Page 12

j) Require the collaboration of international or foreign entities when
The rights of the Holders are affected outside the Colombian territory with
occasion, among others, of the international collection of personal data;
k) Others that are assigned by law.
CHAPTER II
Procedure and sanctions
Article 22. Procedure . The Superintendency of Industry and Commerce, once
established the breach of the provisions of this law by part
of the Responsible for the Treatment or the Person in Charge of the Treatment, will adopt the
measures or impose the corresponding sanctions.
In what is not regulated by this law and the corresponding procedures,
they will follow the pertinent norms of the Contentious Administrative Code.
Article 23. Sanctions . The Superintendency of Industry and Commerce may
impose on those in charge of the treatment and those in charge of the treatment the
following sanctions:
a) Fines of a personal and institutional nature up to the equivalent of two thousand
(2,000) legal monthly minimum wages in force at the time of the
imposition of the sanction. The fines may be successive as long as the
breach that originated them;
b) Suspension of the activities related to the Treatment for up to a
term of six (6) months. In the act of suspension, the corrective measures will be indicated
to be adopted;
c) Temporary closure of the operations related to the Treatment once
after the suspension term has elapsed without the adoption of the
corrective measures ordered by the Superintendency of Industry and Commerce;
d) Immediate and definitive closure of the operation that involves the Treatment of
sensitive data;
Paragraph. The sanctions indicated in this article only apply to the
people of a private nature. In the event in which the Superintendency of
Industry and Commerce warns of an alleged breach of an authority
public to the provisions of this law, will refer the action to the
Office of the Attorney General of the Nation to carry out the investigation
respective.
Article 24. Criteria for graduating sanctions . Penalties for
infractions referred to in the previous article, will be graduated according to
the following criteria, as applicable:
a) The dimension of the damage or danger to the legal interests protected by the

Page 13

present law;
b) The economic benefit obtained by the offender or third parties, by virtue of the
commission of the offense;
c) Recurrence in the commission of the offense;
d) The resistance, refusal or obstruction to the investigative action or
surveillance of the Superintendency of Industry and Commerce;
e) The reluctance or contempt to comply with the orders issued by the
Superintendency of Industry and Commerce;
f) The express recognition or acceptance made by the person under investigation of the
commission of the offense before the imposition of the sanction to which there is
place.
CHAPTER III
From the National Registry of Databases
Article 25. Definition . The National Registry of Databases is the
public directory of the databases subject to Treatment that operate in the
country.
The registry will be administered by the Superintendency of Industry and Commerce and
It will be free for the citizens to consult.
To register the databases, the interested parties must contribute to the
Superintendency of Industry and Commerce the treatment policies of the
information, which will oblige those responsible and in charge of it, and
whose non-compliance will carry the corresponding sanctions. The policies of
Treatment in no case may be less than the duties contained in
this law.
Paragraph. The National Government will regulate, within the year following the
promulgation of this law, the minimum information that the
Registration, and the terms and conditions under which they must be registered in this
the Responsible for the Treatment.
TITLE VIII
DATA TRANSFER TO THIRD COUNTRIES
Article 26. Prohibition . The transfer of personal data from
any kind to countries that do not provide adequate levels of protection
of data. It is understood that a country offers an adequate level of protection of
data when it complies with the standards set by the Superintendency of
Industry and Commerce on the matter, which in no case may be
lower than those required by this law to its recipients.

Page 14

This prohibition will not apply when it comes to:
a) Information for which the Holder has granted his authorization
express and unequivocal for the transfer;
b) Exchange of medical data, when required by the Treatment
of the Holder for reasons of health or public hygiene;
c) Bank or stock transfers, in accordance with the legislation that
applicable;
d) Transfers agreed in the framework of international treaties in the
to which the Republic of Colombia is a party, based on the principle of
reciprocity;
e) Transfers necessary for the execution of a contract between the Holder and
the Responsible for the Treatment, or for the execution of measures
pre-contractual as long as you have the authorization of the Owner;
f) Transfers legally required to safeguard the public interest, or
for the recognition, exercise or defense of a right in a process
judicial.
Paragraph 1. In the cases not contemplated as an exception in the present
article, it will correspond to the Superintendency of Industry and Commerce, to pronounce
the declaration of conformity regarding the international transfer of data
personal. For this purpose, the Superintendent is empowered to request
information and carry out the proceedings aimed at establishing compliance
of the budgets required for the viability of the operation.
Paragraph 2. The provisions contained in this article shall be
applicable to all personal data, including those contemplated
In the law1266 of 2008.
TITLE IX
OTHER PROVISIONS
Article 27. Binding Corporate Rules . The National Government
issue the corresponding regulations on Corporate Standards
Binding for the certification of good practices in data protection,
personal data and their transfer to third countries.
Article 28. Transitional regime . People who on the date of entry
in force of this law exercise any of the activities regulated here
They will have a period of up to six (6) months to adapt to the provisions
contemplated in this law.
Article 29. Repeal . This law repeals all provisions that
are contrary to it except for those contemplated in article 2.

Page 15

Article 30. Validity . This law governs from its promulgation.
The President of the honorable Senate of the Republic,
ROY LEONARDO BARRERAS MONTEALEGRE.
The Secretary General of the honorable Senate of the Republic,
GREGORIO ELJACH PACHECO.
The Speaker of the honorable House of Representatives,
AUGUSTO POSADA SÁNCHEZ.
The Secretary General (E.) of the honorable House of Representatives,
FLOWER MARINA DAZA RAMÍREZ.
REPUBLIC OF COLOMBIA - NATIONAL GOVERNMENT
LET IT BE PUBLISHED AND ENFORCED.
In compliance with the provisions of Judgment C-748 of 2011 delivered
by the Constitutional Court, it proceeds to the sanction of the bill, the
which orders the referral of the file to the Congress of the Republic, for
continue the procedure of rigor and subsequent sending to the President of the
Republic.
Given in Bogotá, DC, on the 17th day of October 2012.
JUAN MANUEL SANTOS CALDERÓN
The Minister of Justice and Law,
RUTH STELLA CORREA PALACIO.
The Minister of Finance and Public Credit,
MAURICIO CÁRDENAS SANTA MARÍA.
The Minister of Commerce, Industry and Tourism,
SERGIO DIAZ-GRANADOS GUIDA.
The Minister of Technologies, Information and Communications,
DIEGO MOLANO VEGA.
NOTE: Published in Official Gazette 48587 of October 18, 2012.

