Colombia Privacy Protection Laws and Regulations

Decree No. 1377 of 2013 was enacted on 27 June 2013. It further refines and regulates the requirements stated in Law No. 1581 of 2012 and provides more specific provisions based on Law No. 1581 of 2012.

Decree No. 1377 of 2013 and Law No. 1581 of 2012 have the same regulatory scope.

Law No. 1266 of 2008 was enacted on 31 December 2008. It regulates the processing of financial data, credit records, and commercial information collected in the country or abroad.

Law No. 1266 of 2008 applies to all personal information data, managed by public or private entities, registered in Colombia's national databases.

Law No. 2157 of 2021 was enacted on October 29, 2021. The main purpose of this law is to amend and supplement Law No.1266 of 2008 and enhance the protection of personal data.

Law No. 2157 of 2021 and Law No.1266 of 2008 have the same regulatory scope.

Guidelines for Implementing the Principle of Accountability in International Transfers of Personal Data contains many recommendations for protecting the transfers of personal data from Colombia to other countries.

These Guidelines apply to the international transfers (cross-border transfers) of all personal data in Colombia.

Colombia's privacy protection laws define three roles: data subject, data controller, and data processor.

A data subject has the right to know, update, and rectify their personal data from the data controller or data processor, the right to ask the data controller or data processor to produce the authorization granted to them, the right to ask the data controller or data processor to inform them of the use of their personal data, the right to appeal to the supervisory authorities to withdraw authorization, the right to require the deletion of personal data, and the right to access the personal data being processed.

Basic obligations of data processors: a data processor shall process personal data as required or agreed by data controllers; protect data subjects' rights; ensure personal data security and accuracy; delete personal data upon expiration; handle data subjects' query and claim requests made in accordance with relevant laws; develop personal data protection policies and processes; record data subjects' appeals in databases; comply with personal data law enforcement requirements of authorities; notify and report violations or data breaches; and comply with instructions and requirements issued by regulators.

Compared with data processors, data controllers shall comply with more specific obligations, including notifications, consents, purpose restriction, protection for data subject's rights, personal data accuracy protection, personal data protection, personal data retention and cross-border transfer restriction, notifications and reporting of personal data breaches, and personal data protection policy development.

For details about each obligation, see Huawei Cloud Compliance with Colombia Privacy Protection Regulations.