ColombiaCódigo Penal, Violación de Datos Personales
Ley 599 de 2000, art. 269F (added by Ley 1273 de 2009)
In force since .
A personal data rule binding public and private bodies.
- Enforcement body
- Fiscalia General de la Nacion
- Obligation class
- Access restriction, Biometric
- Audit expectation
- none
What it requires
- Do not obtain, compile, extract, or use personal data contained in a file, archive, or database without the controller's authorization, even for data found on a public web page.
- A datum being accessible on the internet does not exempt collecting it from Colombia's personal-data authorization requirements.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages (art. 269F).
What it makes you log
Logging duty
Article 269F defines the offence of violating personal data (obtaining, compiling, extracting, trading, disclosing, modifying or using personal data held in files and databases without being authorized, for gain) and sets the penalty. It imposes no duty to create, keep, produce or review a log or record, and states no territorial test, so the hook is empty. The row's other cited page, the Superintendencia de Industria y Comercio circular, is a separate instrument and is not read into this offence.
- Kind
- None
- As of
What this law does
Article 269F punishes whoever, without authorization and for their own or a third party's benefit, obtains, compiles, extracts, offers, sells, exchanges, sends, buys, intercepts, discloses, modifies, or uses personal codes or personal data contained in files, archives, databases, or similar media, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.
Scraping personal data without the controller's authorization can independently expose the scraper to this criminal offense, on top of the administrative duties Ley 1581 de 2012 imposes on the processing itself; the Superintendencia de Industria y Comercio's Circular Externa 002 de 2024 states that personal data being accessible on the internet does not make it data of a public nature, so Colombia's personal-data regime does not carve out publicly accessible personal data from its own reach.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .