Colombia's Habeas Data Law (Law 1581): A Complete Guide for Businesses

A logistics company in Bogotá got a formal request from Colombia's Superintendency of Industry and Commerce a few months back. A former employee had filed a complaint because, two years after leaving the company, he was still getting marketing emails on his personal account. The company had never deleted his data or told him what it was still being used for. It turned into a formal investigation — not because anyone meant harm, but because nobody at the company realized they were required to have a clear process for exactly this situation.

That's how most Colombian businesses first run into Law 1581: not by reading it, but by breaking it without noticing. And the law applies to any business collecting names, emails, ID numbers, or purchase histories — whether you have five employees or five hundred.

Law 1581 of 2012, Colombia's General Regime for Personal Data Protection, gives every person the right to know, update, and correct information a company holds about them. Decree 1377 of 2013 fills in the operational detail — what a valid consent form looks like, what a privacy notice needs to say, when a database has to be registered. The Superintendencia de Industria y Comercio (SIC), through its Data Protection Delegate office, enforces it.

If your business runs a CRM with customer data, keeps employee resumes on file, has a contact form on the website, or has security cameras in the office, the law applies directly. There's no size threshold that exempts you. What does change with company size and sector is how robust your security measures need to be.

The law lists ten guiding principles, but in day-to-day business, three of them cause most of the headaches.

The purpose principle says you can only use a piece of data for what you disclosed when you collected it. If a customer gave you their email to receive an invoice, you can't start sending them a newsletter without asking again — that's exactly the mistake the logistics company made.

The freedom principle requires consent to be prior, express, and informed. A pre-checked box, or authorization buried in paragraph 38 of terms nobody reads, doesn't meet that bar.

And the security principle is where the law stops being a purely legal matter and becomes a technical one: it requires concrete measures to prevent data loss, alteration, or unauthorized access. This is where cybersecurity consulting stops being optional and becomes part of legal compliance itself.

In an audit or formal request, these are the documents they typically ask for:

The SIC can impose fines of up to 2,000 monthly minimum wages, and in serious cases order operations tied to improper data handling to shut down. Over the past two years the Superintendency has been more active, not less, in enforcing this — a rise in reported data leaks across the country has put the issue under more scrutiny than it faced five years ago. There's also a cost that sometimes matters more than the fine itself: SIC decisions are public, so a sanction stays visible to any client researching your business before signing a contract.

You don't need to stop operating to get in order. A realistic path looks like this: