← Global Privacy Laws Research Library
Law 1581 of 2012
Ley Estatutaria 1581 de 2012
Colombia Statutory Law 1581 of 2012
Prepared by Shubhank Suman · Last reviewed
Enacted statutory text; publisher does not guarantee current validity
- Legal character
- National statute
- Region
- Latin America
- Enacted
- 17 October 2012
What it covers
General personal-data protection principles, sensitive and children’s data, data-subject authorisation and rights, notices, consultation/claim procedures, controller and processor duties, SIC oversight, sanctions, database registration and transfers.
Why it matters
The general framework has special-scope exclusions and implementing regulations. It should not be treated as a self-contained consolidation of every Colombian sectoral privacy requirement.
Refer to it when
Research Colombian processing authorisation, sensitive data, children, access/correction, complaints, controller/processor duties, sanctions or cross-border disclosures.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: High
AI
MODERATE
Personal-data AI processing engages authorisation, purpose, transparency and security; no general AI regime or express GDPR-style automated-decision right is asserted.
Privacy
VERY HIGH
General data-protection rights and duties.
Cybersecurity
HIGH
Security/confidentiality principles and organisational duties.
Applicability
Processing registered in databases by public/private entities within article 2, including the specified territorial and international-law connections; statutory exclusions remain subject to the law’s principles where indicated.
Read first
Articles 2-4 → 5-13 → 14-18 → 19-26 → 28.
Provisions / sections covered
Articles 1-4 - Purpose, scope and principles
Purpose, application and exclusions, definitions, legality, purpose, freedom, accuracy, transparency, restricted access, security and confidentiality.
Articles 5-7 - Special categories
Sensitive data and permitted exceptions; children’s protections and the constitutional interpretation must be read together.
Articles 8-16 - Rights and procedures
Rights, prior informed authorisation and exceptions, information, recipients, consultation and complaint procedures; procedural exhaustion before SIC complaints.
Articles 17-25 - Duties and enforcement
Separate controller/processor duties, SIC supervision, sanctions and National Database Register. Public-authority violations have the distinct disciplinary referral mechanism in article 23.
Articles 26-28 - Transfers and closing provisions
Article 26 bars transfers to countries without adequate protection subject to enumerated exceptions and SIC conformity declarations. Article 28 states effect from promulgation; the source does not certify later consolidation.
Subject-matter tags
- Sensitive data
- Children's data
- Cross-border transfers
- Controller and processor
- Enforcement and penalties
- Registration and notification
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.