ColombiaLey 1581 de 2012, General Personal Data Protection
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance, Security, Disclosure
- Audit expectation
- none
What it requires
- Obtain the data subject's prior, explicit and informed authorization before collecting or processing their personal data, unless a statutory exception applies.NIST Privacy FrameworkCT.PO-P1
- Apply the legality, purpose limitation, freedom, accuracy, transparency, restricted access and confidentiality principles to every processing operation, and do not process partial, incomplete, fragmented or misleading personal data.NIST Privacy FrameworkGV.PO-P1
- Keep proof of the data subject's authorization, tell them at authorization the purpose of the processing, keep their personal data updated and accurate, secure it against unauthorized alteration, loss, consultation, use or access, and correct it once it is shown to be incorrect.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkPR.DS-P5
- As a data processor, keep personal data secure in the same way, update or correct it as the controller instructs within five business days, and adopt an internal manual of policies and procedures for handling consultations and claims.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkGV.MT-P7
- Share personal data only with the data subject or their representatives, a public authority acting within its legal functions or under court order, or a third party the data subject or the law has authorized, and supply any information you owe them in an easily readable format matching what is on file.NIST Privacy FrameworkCT.PO-P2
- Register your databases with the Superintendencia de Industria y Comercio's National Registry of Databases and submit data treatment policies that never fall below this law's duties.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DM-P3Data elements can be accessed for alteration.
1 more
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 9 requires the data subject's prior, informed authorization to be obtained by a means that can be consulted later, and article 17(b) has the controller request and keep a copy of that authorization. No other record is named in the articles this row cites: article 25 enters databases and their treatment policies in the national registry the Superintendencia de Industria y Comercio keeps, which is a directory of databases and not a log of processing, and articles 17(k) and 18(f) call for an internal manual of policies, not a record. The statute sets no period for keeping the copy. Article 2 applies the law to processing carried out in Colombian territory, or to a controller outside it to whom Colombian law applies under a treaty or other rule; that test turns on where the processing takes place and not on any of the territorial hooks the corpus records, so no territorial hook is recorded for this row.
- Kind
- Explicit
- As of
- Provision
- Articles 9 and 17(b)
- Trigger
- consent_or_optout
What this law does
Article 1 develops the constitutional right, under article 15 of the 1991 Constitution, of every person to know, update and rectify information collected about them in a database, and article 2 applies the law to personal data registered in any database made susceptible to processing by a public or private entity, exempting only purely personal or household databases, national security and anti money laundering databases, intelligence databases, journalistic databases, and databases the credit reporting law (Ley 1266 de 2008) or the cooperative law (Ley 79 de 1993) already regulates.
Article 4 sets the governing principles, including legality, purpose limitation, freedom of processing tied to the data subject's consent, accuracy, transparency, restricted access and circulation, security and confidentiality.
Article 9 requires the data controller to obtain the data subject's prior and informed authorization before processing their data, and article 10 lists the narrow cases where that authorization is not required, including data a public authority requests in exercise of its legal functions and data of a public nature.
Articles 11 and 13 require any information owed to the data subject to be supplied in an easily readable form matching what is on file, and limit disclosure of personal data to the data subject and their representatives, a public authority acting within its legal functions or under court order, and third parties the data subject or the law has authorized.
Articles 17 and 18 set the controller's and the processor's general duties, including keeping proof of the authorization obtained, telling the data subject the purpose of the processing, keeping the data secure, accurate and updated, correcting it once shown wrong, and adopting an internal manual of policies and procedures for consultations and claims.
Article 25 makes the National Registry of Databases, administered by the Superintendencia de Industria y Comercio, the precondition for registering a database, requiring the interested party to submit data treatment policies that may never fall below this law's own duties. Articles 28 through 30 give a six month transition period, preserve the exceptions of article 2 from the general repeal, and set the law in force from its promulgation on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .