SIC Fines for Data Protection Violations: Real Cases in Colombia

Two thousand monthly minimum wages. That's the ceiling Law 1581 gives Colombia's Superintendency of Industry and Commerce (SIC) to fine a business that violates its personal data protection obligations. In today's pesos, that easily tops COP 2.6 billion for a single infraction. And contrary to what many businesses assume, the SIC doesn't reserve these penalties for massive breach scandals — most of the cases that end up sanctioned start with something far more mundane: a poorly worded consent request, an unregistered database, or a customer complaint that simply never got a response.

This guide walks through why the SIC actually issues fines in practice, the patterns that keep repeating across real cases, and what to do so your business isn't next.

Over the past two years, the SIC has been more active, not less, in opening investigations and issuing sanctions under Law 1581. Part of that reflects a steady rise in complaints from data subjects — people who notice their data is still circulating after asking for it to be deleted, or who start receiving marketing for services they never consented to. The other part reflects a broader regulatory environment that, as we explain in our guide to CONPES 3995, has been pushing toward higher digital protection standards across the country.

Without pointing to specific named cases — because the pattern matters more here than the scandal — these are the causes that consistently sit behind the most common sanctions:

Collecting data without valid consent. It's not just "not asking" — it's asking incorrectly: pre-checked boxes, generic authorizations that don't disclose the real purpose, or forms that bundle multiple purposes under a single acceptance checkbox.

Using data for something other than what was authorized. The classic example: a customer gives their email to receive a purchase invoice, and ends up on a marketing list nobody asked them to join.

Failing to properly respond to data subject rights requests. When someone asks to access, correct, or delete their information, the business has legal deadlines to respond. Ignoring the request, or responding late and incompletely, is one of the most frequent grounds for sanction, precisely because it's the easiest to prove — the data subject simply shows they asked and never got an answer.

Not having a published Data Processing Policy, or having one that doesn't reflect what the business actually does with the information.

Security breaches caused by a lack of reasonable technical measures. This is where technical cybersecurity and legal compliance turn out to be, literally, the same problem viewed from two angles.

The size of the penalty is rarely the biggest cost. SIC decisions are public — any potential client, especially in regulated sectors, can look up a company's sanction history before signing a contract with it. And in sectors where trust is the product — financial services, healthcare, technology — that kind of track record can weigh more heavily in a business negotiation than the fine amount itself.

There's no formula that guarantees zero risk, but these practices consistently lower the odds of ending up under investigation:

A good starting point is our full guide to Colombia's Habeas Data Law, which explains in detail what documents and processes the SIC expects to find.