Colombia

Article 2 of Law 1581 of 2012 applies the regime to processing carried out in Colombian territory, and to processors or controllers not established in Colombia where Colombian law applies under treaties. The Delegate Office for Personal Data Protection went further in Resolution 45710 of 18 June 2026: it 'reiterated that Law 1581 of 2012 applies to anyone who processes personal data in Colombia, even partially, and even when they are not established in Colombia, do not have a branch there, or have not formalized local representation'. Separately, a size threshold does exist but only for one duty: registration in the National Database Registry is required of companies and non-profits with total assets above 100,000 tax units, and of all public bodies. No general obligation to appoint a local representative was found, checked 18 August 2026.

Sector by sector, checked 18 August 2026: BANKING, INSURANCE, PENSIONS, TRUST COMPANIES AND SECURITIES INTERMEDIARIES — rated conditional, and stricter than the national rule. Chapter VI of Part I, Title I of the Financial Superintendency's Basic Legal Circular (added by External Circular 005 of 11 March 2019) lets supervised entities run any process in the cloud, including abroad, but requires them to 'verify that the jurisdictions where the information will be processed have rules equivalent to or higher than those applicable in Colombia' on data protection and computer crime; to check the provider holds ISO 27001; to guarantee the regulator can still reach the systems if the entity is taken over; and to notify the regulator, 15 days before processing begins, of the provider, the subcontractors, the processes involved and 'the physical location or region where the data will be processed and stored'. CREDIT AND FINANCIAL REPORTING DATA — rated conditional, separate statute. Law 1266 of 2008 governs credit bureaus and the sources and users that feed them, and is expressly carved out of the general law. Article 26 of Law 1581 still applies to it. HEALTH — no localisation rule found, checked 18 August 2026. Custody of a clinical record sits with the provider that created it, and the record must be archived under National Archive rules, but nothing found requires Colombian storage. Medical data may also cross borders under the public-health exception in the transfer article. GOVERNMENT, TELECOMS, EDUCATION, GAMING, MAPPING AND DEFENCE — no localisation rule confirmed on an official source within this research budget. Absence of a finding is not proof of absence; each is listed in 'unconfirmed'.

Routes in order of practical use. (1) The published list. Thirty-nine named countries plus all destinations approved by the European Commission. Even then you must be able to show you put real safeguards in place. (2) The six statutory exceptions in article 26 of Law 1581 of 2012: the person's express and unambiguous consent; medical data exchange required for the person's treatment or for public health; banking and stock exchange transfers; transfers under a treaty Colombia has signed, on a reciprocity basis; transfers needed to perform a contract with the person; and transfers required to protect the public interest or to bring or defend a legal claim. (3) The contract route, which is the workhorse. Where the sender signs a contract or other legal instrument with the recipient setting out how the data will be handled, the circular says the operation 'is presumed viable and to have a Declaration of Conformity'. The catch is that the sender must first send a communication to the regulator's data protection division describing the operation and declaring that the contract is signed. (4) A formal Declaration of Conformity applied for in writing, with all supporting documents translated into Spanish. Two useful clarifications sit in the same chapter. Data merely passing through a country on its way somewhere else is not a transfer. And sending data to a supplier abroad who processes it on your behalf — a 'transmission' rather than a 'transfer' — needs no consent and no notice to the individual, provided there is a supplier contract meeting article 25 of Decree 1377 of 2013.

Law 1581 of 2012 names the Superintendency of Industry and Commerce as the data protection authority and gives it investigation, order and penalty powers. Evidence it is operating, gathered 18 August 2026: a published register of data protection sanctions for 2026 containing resolutions dated February, March, May and later; Resolution 45710 of 18 June 2026 dismissing World Foundation's and Tools for Humanity's appeal, with no further appeal available; the thirteenth national data protection conference held on 28 and 29 July 2026, opened by the serving Delegate Superintendent for Personal Data Protection, Juan Carlos Upegui; and a new guidance document for universities published on 13 August 2026. One structural weakness: the penalty regime in article 23 applies only to private bodies. Where a public body breaks the rules, the Superintendency must hand the file to the Attorney General's disciplinary office instead of fining it.

The ceiling comes from article 11 of Decree 1377 of 2013: data may be held only for the time that is reasonable and necessary given the purpose and the administrative, accounting, tax, legal and historical aspects of the information, after which it must be deleted unless a legal or contractual obligation requires it be kept. The same article requires organisations to document their retention and deletion procedures. The credit reporting floor and ceiling are precise. If the arrears lasted less than two years, the negative record may stay for at most twice the length of the arrears. If the arrears lasted two years or more, the negative record stays four years from the date the debt is settled. If the debt is never settled, the record expires eight years after the arrears began — a rule added by Law 2157 of 2021. Health: clinical records stay with the provider that created them and must be organised through management, central and historical archives under General Archive of the Nation rules. Where a provider is wound up, the liquidator must name someone to hold the records for the legally required period. The exact number of years was not confirmed on an official source within this research budget and is listed in 'unconfirmed'. General tax and commercial book retention periods were likewise not confirmed on an official source and should not be relied on from this record.

The instruction covers 'violation of security codes or the loss, theft and/or unauthorised access to information in a database'. Two routes, one deadline. Controllers required to register their databases report the incident as a 'novedad' inside the National Database Registry within 15 working days. Controllers who are not required to register, and all processors, report through the application on the data protection division's pages or any other official channel, also within 15 working days. Incident reports are not published. Count a second clock if you are supervised by the Financial Superintendency, which runs its own information security and cyber incident reporting expectations for banks, insurers and other supervised entities, and a third if a criminal offence is involved. Neither was verified in detail within this research budget.

(1) Children. Decree 1377 of 2013 starts from a prohibition on processing the data of children and adolescents, lifted only where the data is public in nature and the processing respects the child's best interests and fundamental rights, with the legal representative authorising after the child has been heard. Colombia treats everyone under 18 as a child; there is no lower digital consent age as in Europe. The regulator's August 2026 university guidance carves out one narrow area: adolescents over 14 can authorise processing of their own data where that is needed for access to education. (2) The presumed approval trap. Signing a transfer contract does not by itself make a transfer lawful. The circular presumes a Declaration of Conformity only where the sender has first sent a communication to the regulator's data protection division describing the operation and declaring that the contract exists. The regulator can check at any time and investigate if it finds otherwise. (3) Transfer versus transmission. Sending data to a supplier who processes it for you needs no consent and no notice to the individual, but only if there is a contract meeting article 25 of Decree 1377, which must impose principle compliance, security and confidentiality on the supplier. Sending data to another organisation for its own purposes is a transfer, and the article 26 regime applies in full. (4) Advanced cryptography is not anonymisation. In its 2026 decision the regulator rejected the argument that an iris code, encrypted and split across nodes using secure multi-party computation, ceased to be personal data. It held that because the system could still recognise an already-registered person, the link to an identifiable individual survived. (5) Financial cloud pre-notification. Supervised financial entities must send the Financial Superintendency the provider name, the subcontractors, the processes, and the physical location or region of processing and storage, 15 days before processing starts. Changing cloud region is therefore a regulatory event, not just an engineering one.

Do not plan around the reform as if it were law. As at 18 August 2026 the regulator describes it as a debate and a roadmap, not an enacted statute; no adopted replacement for Law 1581 of 2012 was found on an official source. The dormant switches matter more, because each can move without a new law and without consultation: (1) The country list. The circular states plainly that the Superintendency 'shall exercise, at any time, its regulatory capacity to review the above list and proceed to include those not part of it or to exclude whomever it considers appropriate'. A destination you rely on today, including the United States, can be removed by circular. (2) The adequacy standards themselves. The six criteria in numeral 3.1 are the regulator's own, and it can restate them. (3) Security instructions. Article 19 of Decree 1377 of 2013 gives the Superintendency an open mandate to issue instructions on security measures, which is the same power that produced the 15-working-day breach reporting rule. (4) Financial sector timing. The Financial Superintendency issued a 2026 circular extending the start date of the open finance architecture, security and technology standards set by its External Circular 013 of 2025.