Colombia's Law 1581 on Data Protection: A Guide for US Companies

US companies working with remote assistants in Colombia, selling to Colombian customers or using Colombia-based providers often ask how Colombian privacy law affects them. The core of Colombia's framework is Statutory Law 1581 of 2012, which sets general rules for the protection of personal data (Ley 1581 de 2012). It's complemented by regulations, originally Decree 1377 of 2013, and by guidance from the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, SIC), the data protection authority.

This article gives a practical overview for US companies: scope, principles, authorization, sensitive data, rights and response deadlines, the duties of controllers and processors, international transfers, enforcement, and what it means when a remote assistant handles data. It's general information, not legal advice. Get advice from qualified Colombian counsel for your situation.

Scope

Article 2 says the law applies to personal data in any database that makes it subject to processing by public or private entities. It applies to processing carried out in Colombian territory, or when Colombian law applies to a controller or processor not established in Colombia under international norms and treaties. Certain databases are excluded, such as purely personal or household databases and some databases regulated by other laws, like financial credit data covered by Law 1266 of 2008.

For remote staffing, the questions are typically: does a provider in Colombia process personal data, including data about your US customers, and do you process data about people in Colombia, such as customers, leads or candidates?

Key definitions

Article 3 defines the main roles:

• Data controller (Responsable del Tratamiento): the person or entity that decides on the database or the processing.
• Data processor (Encargado del Tratamiento): the person or entity that processes personal data on behalf of the controller.
• Data subject (Titular): the individual whose data is processed.
• Authorization (Autorización): the data subject's prior, express and informed consent.

A Colombian provider handling data under a US client's instructions may be a processor, but roles depend on facts and should be defined in contracts.

Principles

Article 4 sets out principles: legality, purpose, freedom (consent), truthfulness or quality, transparency, restricted access and circulation, security and confidentiality. The confidentiality principle obliges everyone involved in processing to keep information confidential even after their role ends.

Authorization

Under Article 9, processing generally requires the data subject's prior and informed authorization, obtained by any means that can be consulted later. Article 10 lists exceptions, such as information required by a public entity exercising legal functions, data of a public nature, medical emergencies, processing authorized by law for historical, statistical or scientific purposes, and civil registry data.

When requesting authorization, Article 12 requires the controller to inform the data subject clearly about the processing and its purpose, the optional nature of answering questions about sensitive data or data about children, their rights, and the controller's identification and contact details. The controller must keep proof.

Sensitive data

Article 5 defines sensitive data as data affecting the data subject's privacy or whose misuse could cause discrimination, including racial or ethnic origin, political orientation, religious or philosophical beliefs, union membership, health data, sex life and biometric data. Article 6 generally prohibits processing sensitive data, with limited exceptions such as explicit authorization. Assistants who handle health information, HR data or biometric systems need special care.

Data subject rights

Article 8 gives data subjects rights to know, update and rectify their data; request proof of authorization; be informed about how their data has been used; file complaints with the SIC; revoke authorization or request deletion in certain circumstances; and access their data free of charge.

Response deadlines

The law sets specific deadlines:

• Queries (consultas): answered within a maximum of ten business days from receipt, extendable by up to five business days with notice explaining the delay (Article 14).
• Claims (reclamos) to correct, update or delete data, or about non-compliance: answered within a maximum of fifteen business days from the day after receipt, extendable by up to eight business days with notice (Article 15).

Assistants who manage inboxes, customer service or CRM records should be trained to recognize these requests and route them immediately, because the deadline starts when the request arrives.

Duties of controllers and processors

Article 17 lists controller duties, including guaranteeing data subjects' rights, obtaining and keeping authorization, informing data subjects, keeping information secure, ensuring data provided to processors is accurate, adopting an internal manual of policies and procedures, and informing the authority about security violations. Article 18 lists processor duties, including keeping data secure, updating data reported by controllers within five business days, handling queries and claims, allowing access only to authorized people and informing the SIC of security violations.

International transfers

Article 26 prohibits transferring personal data to countries that don't provide adequate levels of protection, as determined by SIC standards, with exceptions, such as the data subject's express and unequivocal authorization, certain medical and banking transfers, transfers under treaties, transfers needed to perform a contract with the data subject, and transfers legally required for public interest or legal claims. Transfers between Colombia and the US in either direction should be reviewed with counsel, including how SIC guidance treats the US and the role of transmission agreements between controllers and processors.

Database registration

Article 25 created the National Registry of Databases (Registro Nacional de Bases de Datos), administered by the SIC. Registration obligations apply to certain controllers, according to the regulations in force. Ask your provider and counsel whether registration applies.

Enforcement

The SIC, through its Delegation for the Protection of Personal Data, oversees compliance (Article 19) and can impose sanctions on private entities, including fines and suspension or closure of processing operations (Article 23).

What this means for remote assistants

Practical steps for US companies working with assistants in Colombia:

• Map data flows: what personal data goes to Colombia, what comes from Colombia and for what purposes.
• Define roles in contracts: controller, processor, instructions, confidentiality and security.
• Train assistants to recognize queries and claims and route them within hours.
• Apply strong security: company-managed accounts, MFA, password manager, least privilege and managed devices. See data security for remote assistants.
• Plan for incidents: include notification duties in your incident response plan.
• Review transfers with counsel.

Recruiting and HR data

Providers in Colombia process candidate and employee data. When you receive resumes or interview candidates, share data only with people involved in hiring, store it securely and don't keep it longer than necessary. Coordinate background or reference checks through your provider. See reference checks for remote assistants.

How ExecWing approaches privacy

ExecWing builds access controls and security practices into each placement and works within your policies and compliance requirements. We don't claim certifications we don't hold; see our security and procurement page for our approach and roadmap. For other markets, see our guides to Mexico's data protection law and the Philippine Data Privacy Act.

A worked example

A US e-commerce company engages a bilingual support assistant in Cali to handle customer inquiries, including from customers in Colombia. Counsel reviews the company's privacy policy and authorization language for Colombian customers. The assistant is trained to tag any request to access, correct or delete data and forward it to the privacy contact the same day, with the receipt date noted. When a Colombian customer asks to update their data, the privacy contact responds well within the statutory deadline.

Common mistakes

Assuming US law covers everything. Colombian law may apply to processing in Colombia.

Missing deadlines. Queries and claims have short statutory deadlines.

Overlooking sensitive data. Health and biometric data require special care.

Unreviewed transfers. Check transfer rules with counsel.

Frequently asked questions

Who enforces Law 1581?

The Superintendence of Industry and Commerce (SIC).

How quickly must we answer a data access request?

Queries must be answered within ten business days, extendable by five with notice. Claims have fifteen business days, extendable by eight.

Does Law 1581 apply to my US company?

It depends on where and how data is processed. Get advice for your situation.

Do assistants need training?

Yes. Recognizing and routing requests quickly is the most important day-to-day task.