Colombia

Article 296 of the Codigo Penal punishes with a fine whoever, to obtain a benefit for themselves or another or to cause harm, substitutes or impersonates a person or attributes to themselves a name, age, marital status, or capacity with legal effects, provided the conduct does not constitute another offense; the article carries no term of imprisonment.

Ley 2502 de 2025 added a second paragraph providing that when the personal falsehood is committed using artificial intelligence, the fine is increased by up to one third, and article 2 defines a deepfake as the creation, modification, or use of a false audiovisual record, including photographs, videos, images or sound recordings, made through artificial intelligence so that it appears to be a real person's authentic speech or conduct.

Article 6 of Ley 2502 de 2025 delayed this amendment's commencement to one year after the law's sanction and promulgation on 28 July 2025, so the deepfake aggravation itself entered into force on 28 July 2026, while the law's other provisions, including its definitions and its public-policy directives to the National Government, the Fiscalia and the Policia Nacional, took effect immediately on sanction.

Article 17(n) requires a data controller to inform the data protection authority when a violation of the security codes occurs and there is a risk in the administration of a data subject's information. Article 18(k) imposes the identical duty on a data processor, requiring it to inform the Superintendencia de Industria y Comercio under the same terms.

Neither literal fixes a deadline for the notice or requires telling the affected data subject directly, so the clock this law states runs only to the Superintendencia, triggered by a security code violation that creates that risk.

Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on June 27, 2013. The chapter does not apply to databases kept in an exclusively personal or domestic setting. Silence is never treated as unequivocal conduct that gives authorization. A controller must keep proof of each authorization a data subject gave for the processing of their data.

Once the purposes of the processing are met, the controller and the processor must delete the personal data they hold, unless a legal or contractual duty requires keeping it. A processing policy must be in a physical or electronic medium, in clear and simple language, and be made known to data subjects. Where the policy cannot be made available to the data subject, the controller must inform the data subject of it by a privacy notice at the latest when the data is collected.

Decreto 886 de 2014, which Chapter 26 of Decreto 1074 de 2015 compiles, entered into force on May 13, 2014. Companies and non-profit entities with total assets above 100,000 UVT, and public legal entities, must register their databases. A controller must register each database that holds personal data separately. A database created after the registration deadlines must be registered within two months of its creation.

The registry holds the controller's identification and contact data, those of any processor, the channels for data subjects to exercise their rights, the name and purpose of the database, whether processing is manual or automated, and the processing policy.

Article 1 develops the constitutional right, under article 15 of the 1991 Constitution, of every person to know, update and rectify information collected about them in a database, and article 2 applies the law to personal data registered in any database made susceptible to processing by a public or private entity, exempting only purely personal or household databases, national security and anti money laundering databases, intelligence databases, journalistic databases, and databases the credit reporting law (Ley 1266 de 2008) or the cooperative law (Ley 79 de 1993) already regulates.

Article 4 sets the governing principles, including legality, purpose limitation, freedom of processing tied to the data subject's consent, accuracy, transparency, restricted access and circulation, security and confidentiality.

Article 9 requires the data controller to obtain the data subject's prior and informed authorization before processing their data, and article 10 lists the narrow cases where that authorization is not required, including data a public authority requests in exercise of its legal functions and data of a public nature.

Articles 11 and 13 require any information owed to the data subject to be supplied in an easily readable form matching what is on file, and limit disclosure of personal data to the data subject and their representatives, a public authority acting within its legal functions or under court order, and third parties the data subject or the law has authorized.

Articles 17 and 18 set the controller's and the processor's general duties, including keeping proof of the authorization obtained, telling the data subject the purpose of the processing, keeping the data secure, accurate and updated, correcting it once shown wrong, and adopting an internal manual of policies and procedures for consultations and claims.

Article 25 makes the National Registry of Databases, administered by the Superintendencia de Industria y Comercio, the precondition for registering a database, requiring the interested party to submit data treatment policies that may never fall below this law's own duties. Articles 28 through 30 give a six month transition period, preserve the exceptions of article 2 from the general repeal, and set the law in force from its promulgation on 17 October 2012.

The SIC's Circular Externa No. 002 de 2024 instructs every data controller and processor subject to Ley 1581 de 2012 and Ley 1266 de 2008 on how those technology neutral statutes apply to developing, deploying, or using an artificial intelligence system that processes personal data.

Instruction I requires that processing to satisfy a four factor weighing test: the processing must be suited to achieve its stated goal, no less intrusive measure must achieve that goal as effectively, the goal itself must be a constitutional one, and the benefit to that goal must not be outweighed by the harm the processing does to the right to data protection.

Instruction II requires an administrator of personal data to refrain from processing, or to adopt precautionary measures, wherever it cannot be certain that processing will not cause serious and irreversible harm, and to adapt its risk management systems to identify, measure, control and monitor the situations that could affect its compliance with personal data protection rules.

The circular next requires a documented privacy impact assessment, covering the processing operations, a specific evaluation of the risks to data subjects' rights and freedoms, and the measures planned to prevent those risks, before an artificial intelligence system likely to pose a high risk to data subjects processes their personal data, requires that data used in an artificial intelligence system be truthful, complete, exact, updated, verifiable and understandable, and requires privacy by design and by default through mathematical techniques such as differential privacy, so that training data cannot identify the person who provided it.

Instruction VIII requires technological, human, administrative, physical and contractual measures against unauthorized access to personal data, its manipulation or destruction, its misuse, and its unauthorized circulation, and requires those security measures to stay auditable by the authorities.

Instruction IX states that personal data being accessible on the internet does not make it data of a public nature, so a controller that collects personal, semiprivate, or sensitive data online is not thereby entitled to treat it for an artificial intelligence system's purposes without the data subject's prior, express and informed authorization.

Section 7 of Chapter 25 was added by Decreto 255 de 2022, which governs from its publication. Decreto 255 de 2022 was published in the Diario Oficial of February 23, 2022. Binding Corporate Rules are mandatory for a business group that transfers personal data to a controller of the group outside Colombia, unless the group applies another transfer mechanism that Colombian law establishes.

Binding Corporate Rules submitted to the Superintendencia take effect only from the date it issues its certification. The group's members are jointly liable for compliance, and the Superintendencia may require, investigate and sanction the controller established in Colombia for infractions by any member of the group.

Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on June 27, 2013. A transmission is processing by a processor on behalf of the controller that involves communicating personal data inside or outside Colombia. An international transmission between a controller and a processor needs neither notice to the data subject nor the data subject's consent when a contract that meets the contract article exists.

The transmission contract must oblige the processor to process the data under the principles that protect it, to safeguard the security of the databases and to keep the data confidential.

Article 26 prohibits transferring personal data of any kind to a country that does not provide an adequate level of data protection, measured by standards the Superintendencia de Industria y Comercio sets and that may never fall below this law's own requirements, unless the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical data exchange required for the data subject's health treatment or public hygiene, the transfer is a banking or securities transfer under its own applicable law, the transfer is agreed under an international treaty Colombia has joined on a reciprocity basis, the transfer is necessary to perform a contract with the data subject or precontractual measures the data subject has authorized, or the transfer is legally required to safeguard the public interest or to establish, exercise or defend a right in a judicial proceeding, and requires the Superintendencia's declaration of conformity before any transfer outside those exceptions.

Article 27 requires the National Government to regulate Binding Corporate Rules certifying good personal data protection practices for a transfer to a third country.

Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on June 27, 2013. A data subject may at any time ask the controller or processor to delete their data or revoke the authorization by filing a claim, and the request does not succeed when the data subject has a legal or contractual duty to remain in the database.

A data subject may consult their personal data free of charge at least once each calendar month and whenever the processing policies change substantially. For consultations more frequent than once a calendar month, the controller may charge only the costs of shipping, reproduction and certification of documents, which may not exceed the cost of recovering the material. Every controller and processor must designate a person or area to handle data subjects' requests to exercise their rights.

The procedures for access, update, deletion, rectification and revocation of authorization must be made known or be easily accessible to data subjects and be included in the processing policy.

Ley 1266 de 2008 entered into force on December 31, 2008. Ley 1266 de 2008 applies to all personal data registered in a data bank, whether run by a public or a private entity. A request to consult personal data in a data bank must be answered within ten business days of receipt, extendable once by no more than five business days when the data subject is told the reasons and the date.

A claim to correct or update data must be answered within fifteen business days from the day after receipt, extendable once by no more than eight business days when the data subject is told the reasons and the date. Within two business days of receiving a complete claim, the operator must add to the individual record a legend that reads reclamo en trámite and states the nature of the claim. A petition or claim not resolved within the deadline is deemed accepted for all legal purposes.

Numeral 8 on silence was added by article 7 of Ley 2157 de 2021. A holder of financial and credit information may also complain to the supervisory authority against sources, operators or users, and ask it to order an operator or source to correct or update their personal data.

Article 8 gives every data subject the right to know, update and rectify their personal data before the controller or processor, request proof of the authorization given, be told on request how their data has been used, file a complaint with the Superintendencia de Industria y Comercio, revoke the authorization or seek deletion of the data where the processing does not respect their constitutional or statutory rights, and access their personal data free of charge.

Article 12 requires the controller, at the moment of requesting authorization, to tell the data subject clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, the rights the data subject holds, and the controller's identification and contact details, and to keep proof that this notice was given.

Article 14 gives the data subject or their successors the right to consult their personal data held in any public or private database, to be answered within ten business days, extendable by five more business days with notice of the delay and a new date.

Article 15 gives the right to lodge a claim for correction, updating or deletion, or over a suspected breach of any duty this law imposes, requires a pending claim legend to be added to the record within two business days of a complete claim, and sets fifteen business days to resolve it, extendable by eight more with notice of the delay and a new date.

Article 16 conditions a complaint to the Superintendencia de Industria y Comercio on having first exhausted the consultation or claim procedure before the controller or processor.

Instruction VII requires an administrator of personal data to guarantee a data subject's right to obtain information about how an artificial intelligence system is processing their personal data, at any time and without restriction.

Instruction X requires the treatment of personal data in an artificial intelligence system to provide pertinent, efficient and demonstrable strategies to guarantee the data subject rights that Ley 1266 de 2008, Ley 1581 de 2012, and their implementing decrees establish.

Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on June 27, 2013. A controller must be able to demonstrate, on the Superintendencia's request, that it has implemented appropriate and effective measures to comply with Ley 1581 de 2012 and the chapter, in proportion to its legal nature and size, the nature of the data, the type of processing and the risks to data subjects.

Effective internal policies must guarantee an administrative structure proportionate to the controller's size, internal mechanisms including training and education programs, and processes for answering data subjects' queries and claims. The Superintendencia's finding that a controller has specific measures and policies for handling personal data properly is weighed when it decides whether to impose sanctions.

The Superintendencia de Industria y Comercio supervises the operators, sources and users of financial, credit, commercial, service and third-country information as to the administration of personal data. Where the source, user or operator of information is an entity supervised by the Superintendencia Financiera de Colombia, that authority supervises it and imposes the sanctions.

The supervisory authority may order, at the cost of the operator, source or user, external systems audits to verify compliance with the law. Fines may reach the equivalent of 2,000 current monthly legal minimum wages at the time of the sanction. Article 14 of Ley 2157 de 2021 modified the fines paragraph of article 18. A data bank's activities may be suspended for up to six months where information is administered in serious violation of the law's conditions and requirements. The operation of data banks that administer prohibited data is closed immediately and permanently.

Article 19 designates the Superintendencia de Industria y Comercio, acting through its Delegatura para la Proteccion de Datos Personales, as the authority that oversees compliance with this law's principles, rights, guarantees and procedures.

Article 21 empowers the Superintendencia to investigate a violation on its own initiative or on complaint and order the measures needed to make the habeas data right effective, temporarily block a controller's processing where the evidence shows a real risk to a data subject's fundamental rights, promote and publicize data subjects' rights, instruct controllers and processors on adapting their operations to this law, issue the declaration of conformity for an international transfer, and administer the National Public Registry of Databases.

Article 22 requires the Superintendencia, once it establishes a violation, to apply the Codigo Contencioso Administrativo for anything this law does not itself regulate, and the sanctions this law provides are purely administrative, since it creates no criminal offense.

Article 23 lets the Superintendencia impose a fine of up to 2,000 current monthly legal minimum wages, suspend the processing activity for up to six months, or order the immediate and permanent closure of an operation that involves sensitive data, reserving these sanctions for private parties and referring a public authority's violation to the Procuraduria General de la Nacion instead.

Article 24 grades a sanction by the extent of the harm or danger, the economic benefit the infringer or a third party obtained, repeat infringement, resistance or obstruction of the investigation, defiance of the Superintendencia's orders, and the infringer's own acknowledgment of the violation before the sanction is imposed.

The circular grounds its artificial intelligence specific duties in the demonstrated accountability rule the Superintendencia de Industria y Comercio already enforces under Decreto 1074 de 2015.

A data controller must be able to show, when the Superintendencia asks, that it has implemented measures that are appropriate and effective to comply with Ley 1581 de 2012 and that decree, and the circular treats the privacy impact assessment and privacy by design duties it imposes as how a controller meets that duty for an artificial intelligence system.

Decreto 1377 de 2013, which Chapter 25 of Decreto 1074 de 2015 compiles, entered into force on June 27, 2013. Processing of sensitive data is prohibited except in the cases expressly listed in article 6 of Ley 1581 de 2012. Where processing sensitive data is allowed, the controller must tell the data subject that they are not obliged to authorize it. No activity may be conditioned on the data subject supplying sensitive personal data.

Processing of the personal data of children and adolescents is prohibited except for data of a public nature, and the processing must respond to and respect the child's best interests and ensure respect for their fundamental rights. The legal representative gives the authorization after the child has exercised the right to be heard, and the child's opinion is weighed by their maturity, autonomy and capacity to understand the matter.

Article 5 defines sensitive data as data that affects a person's privacy or whose misuse can generate discrimination, expressly naming racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, and biometric data.

Article 6 prohibits processing sensitive data unless the data subject gives explicit authorization, the processing protects the data subject's vital interest and they cannot consent, a not for profit political, philosophical, religious or union body processes it about its own members without disclosing it to third parties, the processing establishes, exercises or defends a right in a judicial proceeding, or the processing serves a historical, statistical or scientific purpose and suppresses the data subject's identity.

Article 7 bars processing a child's or adolescent's personal data unless the data is of a public nature, and assigns the State and educational entities the task of informing and training legal representatives, guardians, children and adolescents about the risks of improper processing and the safe, responsible use of their personal data.

Article 269A punishes whoever, without authorization or beyond what was agreed, accesses in whole or part a computer system protected or not by a security measure, or remains within it against the will of the person entitled to exclude them, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.

Because the article expressly covers a system whether or not it is protected by a security measure, its authorization test does not, on its plain text, require defeating a technical access control the way jurisdictions that condition the offense on infringing a security measure do.

Article 12, as rewritten by article 3 of Ley 1915 de 2018, gives the author the exclusive right to authorize or prohibit reproduction of the work by any means or form, permanent or temporary, including temporary electronic storage, as well as communication to the public, distribution, importation, commercial rental, and transformation.

Ley 23 de 1982 creates no text-and-data-mining exception and no machine-readable opt-out mechanism; its narrow enumerated exceptions (quotation with attribution, illustration for non-commercial teaching, single-copy reproduction for private non-commercial use) do not create a general ground for reproducing copyrighted text to train a model.

Colombian copyright law confers no sui generis database right; a compilation is protected only as a collective work for eighty years from publication in favor of its director, under article 24.

Article 269F punishes whoever, without authorization and for their own or a third party's benefit, obtains, compiles, extracts, offers, sells, exchanges, sends, buys, intercepts, discloses, modifies, or uses personal codes or personal data contained in files, archives, databases, or similar media, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.

Scraping personal data without the controller's authorization can independently expose the scraper to this criminal offense, on top of the administrative duties Ley 1581 de 2012 imposes on the processing itself; the Superintendencia de Industria y Comercio's Circular Externa 002 de 2024 states that personal data being accessible on the internet does not make it data of a public nature, so Colombia's personal-data regime does not carve out publicly accessible personal data from its own reach.

Circular Externa 033 de 2020 (External Circular 33 of 2020) of the Superintendencia Financiera de Colombia, the financial regulator, is dated November 17, 2020 and addressed to the legal representatives and statutory auditors of the entities subject to the Superintendencia's inspection and supervision and to the PILA information operators.

Its first instruction adds numeral 5 to Chapter V of Title IV of Part I of the Circular Básica Jurídica (the Superintendencia's basic legal circular), on the minimum requirements for managing information security and cybersecurity, to define a single taxonomy for reporting cybersecurity incidents and to adopt the Traffic Light Protocol (TLP) for reporting cyber incidents to the Superintendencia.

The second instruction creates Formato 408 (Proforma F.000-164) for reporting information security and cybersecurity metrics, with mandatory transmission tests between 18 and 22 January 2021 and a first official transmission with data as of 31 March 2021. Under the fifth instruction, security and cybersecurity incidents must continue to be reported to the mailbox riesgooperativo@superfinanciera.gov.co, using the labeling protocol and taxonomy the circular defines.

Section III applies to the concessionaires of spaces on Canal UNO, to the operators of open television with national, regional and local coverage, and to the concessionaires of subscription television in their own production channel. Article 15.2.3.4 lists the access systems as interpretation in Colombian Sign Language, closed caption in Spanish and subtitling in Spanish.

Article 15.2.3.9, as replaced by Resolución CRC 7810 de 2025, requires the operators of the public television service to implement the access systems in their programming. Article 15.2.3.9 requires private national open television operators and the concessionaires of public television spaces to implement closed caption or subtitling of the main channel and Colombian Sign Language in at least one daily news programme.

Article 15.2.3.8 requires the access systems in the programming broadcast between 6:00 and 23:59. Article 15.2.3.7 excepts the transmission of sports and musical events. Article 15.2.3.14 forbids closed, subscription and non-profit community television operators to restrict, modify or deactivate the access systems included in the signals of the Colombian open television channels. Article 15.2.3.17 leaves out of the count the programmes the same concessionaire rebroadcasts as repeats.

Article 15.2.3.12 requires the viewers' ombudsman, at least once each semester, to state whether petitions, complaints or suggestions on the Section were received and the answers given. Article 15.2.3.14 provides that a breach of its prohibition is investigated and sanctioned under the rules that apply to the operator's modality.

Section III sits in Chapter II of Title XV, on the protection of the television viewer, and Article 22(27) of Ley 1341 de 2009 charges the Commission with overseeing and sanctioning conduct against the rights of television viewers with the sanctions of Article 65.

Article 65 of Ley 1341 de 2009 provides for a warning, a fine of up to 2,000 legal monthly minimum wages for a natural person and up to 15,000 for a legal person, suspension of operation to the public for up to two months, and termination of the contract or cancellation of the licence, authorization or permit.

The Commission issued Resolución CRC 6261 de 2021, which added the Section to Resolution 5050 in compiling the rules of the former television authorities, on 26 March 2021, and it was published in Diario Oficial No. 51.628 the same day. Resolución CRC 7810 de 2025 replaced Article 15.2.3.9 and took effect on its publication in Diario Oficial No. 53.151 of 16 June 2025.

Article 14, item 1, requires the public and private entities in charge of providing public services of any kind to carry out their functions, powers, corporate purposes and all their activities following the principles of universal design, so that no person is excluded or limited in access in conditions of equality because of disability. Those entities must design, implement and finance all the reasonable adjustments needed to meet the purposes of Article 9 of Ley 1346 de 2009.

The opening sentence of Article 14 lists information and communications, including information and communication systems and technologies, among the things to which access must be guaranteed. The paragraph of Article 14 requires its measures to be implemented in accordance with Ley 1287 de 2009 and the other rules on accessibility for the population with disabilities.

Article 31 makes the omission of the obligations of the Law a serious fault under the disciplinary regime for public employees, official workers, members of popularly elected bodies, State contractors and private persons that perform public functions.

Article 8 requires every establishment open to the public that provides Internet services, or an internet cafe, to install the screen-reader software in at least one terminal. The duty follows the acquisition of the country licence for that software by the Ministry of Information and Communications Technologies.

Article 2 applies the Resolution to the subjects obligated by Article 5 of Ley 1712 de 2014. Article 3 requires those subjects, from 1 January 2022, to meet level AA of version 2.1 of the Web Content Accessibility Guidelines issued by the W3C. The duty applies in every process of updating, structuring, restructuring, design and redesign of their web portals and electronic offices, and to the existing contents of those.

Annex 1 requires all new videos to offer closed captions that users can activate, except live transmissions. Annex 1 requires a link to a site map in the footer of the site and a site map in XML format. Annex 1 requires the entities of the national government to present four kinds of video with Colombian Sign Language interpretation.

Chapter 3 of Annex 1 sets accessibility criteria for the digital documents published on the web: word-processor documents, spreadsheets, PDF documents and presentations. Article 8 sets 31 December 2021 as the latest day to implement Article 3. Ley 1712 de 2014 reaches persons that provide public services or perform public functions only with respect to the information directly related to that service or function.

Article 5(c) of Ley 1712 de 2014 binds natural and legal persons, public or private, that provide public services, with respect to the information directly related to the service. Article 5(e) binds political parties and movements and significant groups of citizens.

Article 2.1.1.1.2 of Decreto 1081 de 2015 applies its Title to the subjects in literals c, d and f and the last paragraph of Article 5 with respect to the information related to the public function or service they provide, or the public funds they receive, intermediate or administer. Article 8 requires the obligated subjects, at the request of the authorities of the communities, to publish public information in diverse languages and to prepare alternative formats those groups can understand.

Article 8 also requires the communication media to be adapted so that persons in a situation of disability can access that information. Article 2.1.1.2.2.1 of the Decree understands by alternative format the form, size or mode in which the information is presented for ethnic and cultural groups and for persons in a situation of disability.

Article 2.1.1.2.2.2 of the Decree requires all electronic communication media used to disclose the information to meet the accessibility directives that the Ministry of Information and Communications Technologies issues.

Article 33 permits reproducing any title, photograph, illustration or commentary about a current event that has been published by the press or broadcast by radio or television, unless this has been expressly prohibited. Article 34 makes it lawful to reproduce, distribute, and communicate to the public news or other information about facts or events that have already been publicly disseminated by the press or broadcasting, with no authorization required.

Article 35 lets speeches, addresses, sermons and similar works delivered in public be published as current-events news in the press, by radio or by television without authorization, unless the author has expressly reserved ownership, though such works may not be published in a separate collection without the author's permission. None of the three articles caps a headline's or extract's length beyond the express-prohibition and non-collection conditions they each state.