Colombia

Article 17(n) requires a data controller to inform the data protection authority when a violation of the security codes occurs and there is a risk in the administration of a data subject's information. Article 18(k) imposes the identical duty on a data processor, requiring it to inform the Superintendencia de Industria y Comercio under the same terms.

Neither literal fixes a deadline for the notice or requires telling the affected data subject directly, so the clock this law states runs only to the Superintendencia, triggered by a security code violation that creates that risk.

Article 1 develops the constitutional right, under article 15 of the 1991 Constitution, of every person to know, update and rectify information collected about them in a database, and article 2 applies the law to personal data registered in any database made susceptible to processing by a public or private entity, exempting only purely personal or household databases, national security and anti money laundering databases, intelligence databases, journalistic databases, and databases the credit reporting law (Ley 1266 de 2008) or the cooperative law (Ley 79 de 1993) already regulates.

Article 4 sets the governing principles, including legality, purpose limitation, freedom of processing tied to the data subject's consent, accuracy, transparency, restricted access and circulation, security and confidentiality.

Article 9 requires the data controller to obtain the data subject's prior and informed authorization before processing their data, and article 10 lists the narrow cases where that authorization is not required, including data a public authority requests in exercise of its legal functions and data of a public nature.

Articles 11 and 13 require any information owed to the data subject to be supplied in an easily readable form matching what is on file, and limit disclosure of personal data to the data subject and their representatives, a public authority acting within its legal functions or under court order, and third parties the data subject or the law has authorized.

Articles 17 and 18 set the controller's and the processor's general duties, including keeping proof of the authorization obtained, telling the data subject the purpose of the processing, keeping the data secure, accurate and updated, correcting it once shown wrong, and adopting an internal manual of policies and procedures for consultations and claims.

Article 25 makes the National Registry of Databases, administered by the Superintendencia de Industria y Comercio, the precondition for registering a database, requiring the interested party to submit data treatment policies that may never fall below this law's own duties. Articles 28 through 30 give a six month transition period, preserve the exceptions of article 2 from the general repeal, and set the law in force from its promulgation on 17 October 2012.

The SIC's Circular Externa No. 002 de 2024 instructs every data controller and processor subject to Ley 1581 de 2012 and Ley 1266 de 2008 on how those technology neutral statutes apply to developing, deploying, or using an artificial intelligence system that processes personal data.

Instruction I requires that processing to satisfy a four factor weighing test: the processing must be suited to achieve its stated goal, no less intrusive measure must achieve that goal as effectively, the goal itself must be a constitutional one, and the benefit to that goal must not be outweighed by the harm the processing does to the right to data protection.

Instruction II requires an administrator of personal data to refrain from processing, or to adopt precautionary measures, wherever it cannot be certain that processing will not cause serious and irreversible harm, and to adapt its risk management systems to identify, measure, control and monitor the situations that could affect its compliance with personal data protection rules.

The circular next requires a documented privacy impact assessment, covering the processing operations, a specific evaluation of the risks to data subjects' rights and freedoms, and the measures planned to prevent those risks, before an artificial intelligence system likely to pose a high risk to data subjects processes their personal data, requires that data used in an artificial intelligence system be truthful, complete, exact, updated, verifiable and understandable, and requires privacy by design and by default through mathematical techniques such as differential privacy, so that training data cannot identify the person who provided it.

Instruction VIII requires technological, human, administrative, physical and contractual measures against unauthorized access to personal data, its manipulation or destruction, its misuse, and its unauthorized circulation, and requires those security measures to stay auditable by the authorities.

Instruction IX states that personal data being accessible on the internet does not make it data of a public nature, so a controller that collects personal, semiprivate, or sensitive data online is not thereby entitled to treat it for an artificial intelligence system's purposes without the data subject's prior, express and informed authorization.

Article 26 prohibits transferring personal data of any kind to a country that does not provide an adequate level of data protection, measured by standards the Superintendencia de Industria y Comercio sets and that may never fall below this law's own requirements, unless the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical data exchange required for the data subject's health treatment or public hygiene, the transfer is a banking or securities transfer under its own applicable law, the transfer is agreed under an international treaty Colombia has joined on a reciprocity basis, the transfer is necessary to perform a contract with the data subject or precontractual measures the data subject has authorized, or the transfer is legally required to safeguard the public interest or to establish, exercise or defend a right in a judicial proceeding, and requires the Superintendencia's declaration of conformity before any transfer outside those exceptions.

Article 27 requires the National Government to regulate Binding Corporate Rules certifying good personal data protection practices for a transfer to a third country.

Article 8 gives every data subject the right to know, update and rectify their personal data before the controller or processor, request proof of the authorization given, be told on request how their data has been used, file a complaint with the Superintendencia de Industria y Comercio, revoke the authorization or seek deletion of the data where the processing does not respect their constitutional or statutory rights, and access their personal data free of charge.

Article 12 requires the controller, at the moment of requesting authorization, to tell the data subject clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, the rights the data subject holds, and the controller's identification and contact details, and to keep proof that this notice was given.

Article 14 gives the data subject or their successors the right to consult their personal data held in any public or private database, to be answered within ten business days, extendable by five more business days with notice of the delay and a new date.

Article 15 gives the right to lodge a claim for correction, updating or deletion, or over a suspected breach of any duty this law imposes, requires a pending claim legend to be added to the record within two business days of a complete claim, and sets fifteen business days to resolve it, extendable by eight more with notice of the delay and a new date.

Article 16 conditions a complaint to the Superintendencia de Industria y Comercio on having first exhausted the consultation or claim procedure before the controller or processor.

Instruction VII requires an administrator of personal data to guarantee a data subject's right to obtain information about how an artificial intelligence system is processing their personal data, at any time and without restriction.

Instruction X requires the treatment of personal data in an artificial intelligence system to provide pertinent, efficient and demonstrable strategies to guarantee the data subject rights that Ley 1266 de 2008, Ley 1581 de 2012, and their implementing decrees establish.

Article 19 designates the Superintendencia de Industria y Comercio, acting through its Delegatura para la Proteccion de Datos Personales, as the authority that oversees compliance with this law's principles, rights, guarantees and procedures.

Article 21 empowers the Superintendencia to investigate a violation on its own initiative or on complaint and order the measures needed to make the habeas data right effective, temporarily block a controller's processing where the evidence shows a real risk to a data subject's fundamental rights, promote and publicize data subjects' rights, instruct controllers and processors on adapting their operations to this law, issue the declaration of conformity for an international transfer, and administer the National Public Registry of Databases.

Article 22 requires the Superintendencia, once it establishes a violation, to apply the Codigo Contencioso Administrativo for anything this law does not itself regulate, and the sanctions this law provides are purely administrative, since it creates no criminal offense.

Article 23 lets the Superintendencia impose a fine of up to 2,000 current monthly legal minimum wages, suspend the processing activity for up to six months, or order the immediate and permanent closure of an operation that involves sensitive data, reserving these sanctions for private parties and referring a public authority's violation to the Procuraduria General de la Nacion instead.

Article 24 grades a sanction by the extent of the harm or danger, the economic benefit the infringer or a third party obtained, repeat infringement, resistance or obstruction of the investigation, defiance of the Superintendencia's orders, and the infringer's own acknowledgment of the violation before the sanction is imposed.

The circular grounds its artificial intelligence specific duties in the demonstrated accountability rule the Superintendencia de Industria y Comercio already enforces under Decreto 1074 de 2015.

A data controller must be able to show, when the Superintendencia asks, that it has implemented measures that are appropriate and effective to comply with Ley 1581 de 2012 and that decree, and the circular treats the privacy impact assessment and privacy by design duties it imposes as how a controller meets that duty for an artificial intelligence system.

Article 5 defines sensitive data as data that affects a person's privacy or whose misuse can generate discrimination, expressly naming racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, and biometric data.

Article 6 prohibits processing sensitive data unless the data subject gives explicit authorization, the processing protects the data subject's vital interest and they cannot consent, a not for profit political, philosophical, religious or union body processes it about its own members without disclosing it to third parties, the processing establishes, exercises or defends a right in a judicial proceeding, or the processing serves a historical, statistical or scientific purpose and suppresses the data subject's identity.

Article 7 bars processing a child's or adolescent's personal data unless the data is of a public nature, and assigns the State and educational entities the task of informing and training legal representatives, guardians, children and adolescents about the risks of improper processing and the safe, responsible use of their personal data.

Article 269A punishes whoever, without authorization or beyond what was agreed, accesses in whole or part a computer system protected or not by a security measure, or remains within it against the will of the person entitled to exclude them, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.

Because the article expressly covers a system whether or not it is protected by a security measure, its authorization test does not, on its plain text, require defeating a technical access control the way jurisdictions that condition the offense on infringing a security measure do.

Article 12, as rewritten by article 3 of Ley 1915 de 2018, gives the author the exclusive right to authorize or prohibit reproduction of the work by any means or form, permanent or temporary, including temporary electronic storage, as well as communication to the public, distribution, importation, commercial rental, and transformation.

Ley 23 de 1982 creates no text-and-data-mining exception and no machine-readable opt-out mechanism; its narrow enumerated exceptions (quotation with attribution, illustration for non-commercial teaching, single-copy reproduction for private non-commercial use) do not create a general ground for reproducing copyrighted text to train a model.

Colombian copyright law confers no sui generis database right; a compilation is protected only as a collective work for eighty years from publication in favor of its director, under article 24.

Article 269F punishes whoever, without authorization and for their own or a third party's benefit, obtains, compiles, extracts, offers, sells, exchanges, sends, buys, intercepts, discloses, modifies, or uses personal codes or personal data contained in files, archives, databases, or similar media, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.

Scraping personal data without the controller's authorization can independently expose the scraper to this criminal offense, on top of the administrative duties Ley 1581 de 2012 imposes on the processing itself; the Superintendencia de Industria y Comercio's Circular Externa 002 de 2024 states that personal data being accessible on the internet does not make it data of a public nature, so Colombia's personal-data regime does not carve out publicly accessible personal data from its own reach.

Article 33 permits reproducing any title, photograph, illustration or commentary about a current event that has been published by the press or broadcast by radio or television, unless this has been expressly prohibited. Article 34 makes it lawful to reproduce, distribute, and communicate to the public news or other information about facts or events that have already been publicly disseminated by the press or broadcasting, with no authorization required.

Article 35 lets speeches, addresses, sermons and similar works delivered in public be published as current-events news in the press, by radio or by television without authorization, unless the author has expressly reserved ownership, though such works may not be published in a separate collection without the author's permission. None of the three articles caps a headline's or extract's length beyond the express-prohibition and non-collection conditions they each state.