Is consent required before collecting data in Colombia?

Yes. Law 1581 generally requires prior, express and informed consent, with explicit consent for sensitive data.

Who enforces Colombia's data protection law?

The Superintendencia de Industria y Comercio, known as the SIC, supervises and enforces the regime.

Colombia

Law 1581

General Data Protection Regime (Law 1581 of 2012)

Colombia's data protection law is consent-driven. Prior, express and informed consent is generally required before collecting personal data, and consent for sensitive data must be explicit and cannot be a condition of service.

Region

Colombia

Status

In force since 2012

Group

Americas

Who must comply

Any controller or processor handling personal data registered or processed in Colombia.

Penalties

Fines up to 2,000 times the current monthly legal minimum wage, plus possible suspension of activities and database closure.

Key obligations

Obtain prior, express and informed consent
Register databases with the national registry
Provide a clear privacy policy and purposes
Honor rights to know, update, rectify and delete
Apply security measures and report relevant incidents

How ConsentX helps

Prior, express opt-in consent capture

Explicit handling for sensitive categories

Rights request intake and workflow

Consent receipts and evidence logs

Region rule engine tuned for Colombia

This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.

Get Law 1581 ready with ConsentX

Get started free Book a demo

How to comply with Law 1581 using ConsentX

1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Law 1581.
2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Law 1581 requires, automatically.
3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Law 1581 audit.
5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.