Colombia

Article 2 of Law 1581 of 2012 covers the use of personal data inside Colombia. It also covers companies not based in Colombia where Colombian law applies under a treaty. The Delegate Office for Personal Data Protection went further in Resolution 45710 of 18 June 2026. It repeated that Law 1581 of 2012 applies to anyone who uses personal data in Colombia, even in part. That holds even if you are not based there, have no branch there, and have never set up formal local representation. A size limit does exist, but only for one duty. Companies and non-profits with total assets above 100,000 tax units must register in the National Database Registry. So must all public bodies. We found no general requirement to appoint a local representative, checked 18 August 2026.

Industry by industry, checked 18 August 2026: BANKING, INSURANCE, PENSIONS, TRUST COMPANIES AND SECURITIES INTERMEDIARIES. Conditions apply, and they are stricter than the national rule. Chapter VI of Part I, Title I of the Financial Superintendency's Basic Legal Circular sets them out. It was added by External Circular 005 of 11 March 2019. Supervised firms may run any process in the cloud, including abroad. First you must check the laws of every country where the data will be handled. Their data protection and computer crime laws must equal or beat Colombia's. You must check the provider holds ISO 27001. You must guarantee the regulator can still reach the systems if the firm is taken over. And you must tell the regulator 15 days before you start. Name the provider, the subcontractors, the processes involved, and the physical location or region where the data will be handled and stored. CREDIT AND FINANCIAL REPORTING DATA. Conditions apply, under a separate law. Law 1266 of 2008 governs credit bureaus and the lenders and users that feed them. It sits outside the general privacy law. Article 26 of Law 1581 still applies to it. HEALTH. We found no rule requiring health data to stay in Colombia, checked 18 August 2026. The provider that created a clinical record keeps custody of it. The record must be archived under National Archive rules. Nothing we found requires Colombian storage. Medical data may also cross borders under the public health exception in the transfer article. GOVERNMENT, TELECOMS, EDUCATION, GAMING, MAPPING AND DEFENCE. We could not confirm any rule requiring data to stay in Colombia in these areas against an official source. Finding nothing is not proof that nothing exists. Each is listed under 'unconfirmed'.

Here are the routes, in order of how often they are used. (1) The published list. Thirty-nine named countries, plus every destination approved by the European Commission. Even then you must be able to show you put real safeguards in place. (2) The six exceptions in article 26 of Law 1581 of 2012. The person gives express and unambiguous consent. Medical data is exchanged for the person's treatment or for public health. The transfer is a banking or stock exchange transfer. The transfer is made under a treaty Colombia has signed, on a reciprocal basis. The transfer is needed to perform a contract with the person. Or the transfer is needed to protect the public interest, or to bring or defend a legal claim. (3) The contract route, which most companies use. You sign a contract with the recipient setting out how the data will be handled. The circular then treats the transfer as viable and as having a Declaration of Conformity. The catch is that you must first write to the regulator's data protection division. Describe the transfer and state that the contract is signed. (4) A formal Declaration of Conformity. You apply in writing, with all supporting documents translated into Spanish. Two other points sit in the same chapter. Data merely passing through a country on its way somewhere else does not count as a transfer. And sending data to a supplier abroad who handles it on your behalf is a 'transmission', not a 'transfer'. That needs no consent and no notice to the individual. You do need a supplier contract meeting article 25 of Decree 1377 of 2013.

Law 1581 of 2012 names the Superintendency of Industry and Commerce as the data protection authority. It can investigate, give orders and impose penalties. Here is what we saw on 18 August 2026. A published register of data protection penalties for 2026, with decisions dated February, March, May and later. Resolution 45710 of 18 June 2026, dismissing the appeal by World Foundation and Tools for Humanity, with no further appeal available. The thirteenth national data protection conference, held on 28 and 29 July 2026. It was opened by the serving Delegate Superintendent for Personal Data Protection, Juan Carlos Upegui. And new guidance for universities, published on 13 August 2026. There is one structural weakness. The penalties in article 23 apply only to private bodies. If a public body breaks the rules, the Superintendency cannot fine it. It must hand the file to the Attorney General's disciplinary office instead.

The maximum comes from article 11 of Decree 1377 of 2013. You may hold data only for the time that is reasonable and necessary for the purpose. You must also weigh the administrative, accounting, tax, legal and historical sides of the information. After that you must delete it, unless a law or contract requires you to keep it. The same article requires you to write down your keeping and deletion procedures. The credit reporting limits are precise. If the arrears lasted less than two years, the negative record may stay for at most twice the length of the arrears. If the arrears lasted two years or more, the negative record stays four years from the date the debt is settled. If the debt is never settled, the record expires eight years after the arrears began. Law 2157 of 2021 added that last rule. Health. Clinical records stay with the provider that created them. They must be organised through management, central and historical archives under General Archive of the Nation rules. If a provider is wound up, the liquidator must name someone to hold the records for the period the law requires. We could not confirm the exact number of years against an official source. It is listed under 'unconfirmed'. We also could not confirm general tax and commercial book keeping periods, so do not rely on this record for those.

The rule covers a breach of security codes, and the loss, theft or unauthorised access to information in a database. There are two routes and one deadline. If you must register your databases, report the incident as a 'novedad' inside the National Database Registry within 15 working days. You may not have to register, or you may be a supplier handling data for someone else. Then report through the form on the data protection division's pages, or any other official channel. The deadline is the same 15 working days. Incident reports are not published. There is a second deadline if the Financial Superintendency supervises you. It sets its own information security and cyber incident reporting expectations for banks, insurers and other supervised firms. There is a third if a crime is involved. We did not verify either in detail.

(1) Children. Decree 1377 of 2013 starts from a ban on using the data of children and teenagers. The ban lifts only where the data is public in nature. The use must respect the child's best interests and basic rights. The legal representative must authorise it after the child has been heard. Colombia treats everyone under 18 as a child. There is no lower digital consent age as in Europe. The regulator's August 2026 university guidance opens one narrow gap. Teenagers over 14 can authorise the use of their own data where that is needed to get access to education. (2) The presumed approval trap. Signing a transfer contract does not by itself make a transfer lawful. The circular presumes a Declaration of Conformity only if you have first written to the regulator's data protection division. Your letter must describe the transfer and state that the contract exists. The regulator can check at any time and investigate if it finds otherwise. (3) Transfer versus transmission. Sending data to a supplier who handles it for you needs no consent and no notice to the individual. But that only holds if you have a contract meeting article 25 of Decree 1377. The contract must bind the supplier to the privacy principles, to security and to confidentiality. Sending data to another organisation for its own purposes is a transfer. Then the article 26 rules apply in full. (4) Advanced cryptography does not make data anonymous. In its 2026 decision the regulator rejected the argument that an iris code stopped being personal data. The code was encrypted and split across nodes using secure multi-party computation. The regulator held that the system could still recognise someone already registered. So the link to an identifiable person survived. (5) Financial cloud notice in advance. Supervised financial firms must report to the Financial Superintendency. Give the provider name, the subcontractors, the processes, and the physical location or region where data is handled and stored. Send it 15 days before you start. Changing cloud region is a regulatory event, not just an engineering one.

Do not plan around the reform as if it were law. As at 18 August 2026 the regulator calls it a debate and a roadmap. It is not an enacted statute. We found no adopted replacement for Law 1581 of 2012 on an official source. Four things matter more, because each can change with no new law and no consultation. (1) The country list. The circular says plainly that the Superintendency may review the list at any time. It can add countries or remove any it chooses. A destination you rely on today, including the United States, can be dropped by circular. (2) The standards used to judge countries. The six tests in numeral 3.1 are the regulator's own. It can restate them. (3) Security instructions. Article 19 of Decree 1377 of 2013 gives the Superintendency an open mandate to issue instructions on security measures. That is the same power that produced the 15-working-day breach reporting rule. (4) Financial sector timing. The Financial Superintendency issued a 2026 circular extending the start date of the open finance architecture, security and technology standards. Those were set by its External Circular 013 of 2025.