Ley 81 de 2019, Sobre Protección de Datos Personales

Article 1 sets the Law's object as the principles, rights, obligations and procedures that govern personal data protection, and lets any natural or legal person, public or private, for profit or not, process personal data provided it does so under the Law and for permitted purposes.

Article 6 conditions any processing of personal data on the data subject's consent, contractual necessity, a legal obligation, or authorization under a special law, requires the person consenting to be duly informed of the purpose, and lets consent be revoked without retroactive effect.

Article 11 confines personal data to the determined, explicit and lawful purposes disclosed when it was collected, and bars any other use absent the data subject's consent, a special law, contractual necessity, or a public entity's legal functions or a judicial order. Article 9 obliges everyone with access to personal data, in public or private organizations, to keep it confidential when it did not come from a source open to the public, an obligation that survives the end of their involvement.

Article 14 makes a database custodian answerable for damages its own lack of due diligence causes. Article 26 requires an operator of a public communications network to adopt technical and management measures that secure its network and services to the standard this Law sets. Article 27 requires an online collector to present an accessible privacy policy or terms of service, set apart from other terms in clear and simple language where consent is bundled with them.

Article 28 bars disclosing or communicating data identifying a person once seven years have passed since the legal duty to retain it ended, unless that data subject expressly asks otherwise.

Article 29 confines a public entity's processing of personal data to matters within its own competence, and article 30 bars a public entity from disclosing a data subject's criminal or disciplinary record once the underlying sanction has lapsed or been served, except to a competent court or another public body bound to the same confidentiality.

Article 24 requires a database custodian to hand stored or transferred personal data to a competent judicial authority on a properly substantiated request, and bars any mass request for personal data outright.

Articles 31 and 32 require a registry of every database disclosed to third parties, naming the database, its legal basis, how it is obtained and treated, its recipients, retention periods and everyone who accessed it, and require a disclosure request itself to identify the requester and purpose, notify the data subject, and state how long the data will be used and how it will be destroyed.

Article 44 extends the Law's rights to personal data already held in a database that existed before the Law took effect. Article 47 sets the Law's entry into force two years after its promulgation, and the Law's 29 March 2019 Gaceta Oficial publication places that entry into force on 29 March 2021.