What Is Ley 1581 de 2012?
Colombia's Law 1581 of 2012 is confirmed in force per current official normative records, entering into force 17 October 2012. The Superintendencia de Industria y Comercio (SIC), through its Personal Data Protection Delegation, is the authority for the general regime. The official text supports a broad general regime for personal data in public and private databases, but it contains material exclusions and special-regime boundaries: personal/domestic processing, national-security/intelligence processing, journalistic/editorial processing, and databases regulated by the financial habeas data regime under Law 1266. Law 1581's principles still apply to the listed exclusions within the statutory limits, and a database used for both credit-risk and other purposes may be subject to both regimes. The current normative record states a ten-business-day consultation deadline and a fifteen-business-day claim deadline, with bounded extensions and cure rules. Article 16 requires exhaustion of the controller/processor consultation or claim process before filing an SIC complaint; the SIC publishes a current online Personal Data Complaints service and PQRSF route for that purpose.
At a glance
- Full name
- Ley 1581 de 2012
- Short code
- Law 1581
- Jurisdiction
- Colombia
- Enacted
- 2012
- Last major update
- Confirmed in force in the 7 September 2026 review; entry into force 17 October 2012
- Regulator
- Superintendencia de Industria y Comercio (SIC), Delegatura para la Protección de Datos Personales
- Private right of action
- Limited
- Statutory citation
- Ley 1581 de 2012
Scope, who Law 1581 covers
Protected data
Data subject rights
Consultation of personal data held about the data subject
Claim (rectification, updating, or deletion of data, or of a suspected legal violation)
Consultation response within 10 business days
Claim response within 15 business days, with bounded extensions and cure rules
Complaint to the SIC after exhausting the controller/processor consultation or claim process
Notable features
Colombia's regime is deliberately layered: Law 1581 provides the general personal-data framework, while Law 1266 of 2008 supplies special rules for financial, credit, commercial, and services data. The regimes should not be collapsed into one statute, but the Law 1581 principles can apply concurrently and mixed-purpose databases may fall under both. SIC's current investigation procedure is version 5, effective 30 April 2026; that is an administrative procedure update, not a replacement for Law 1581.
Enforcement & penalties
Regulator: Superintendencia de Industria y Comercio (SIC), Delegatura para la Protección de Datos Personales
Penalties: Not independently confirmed in the 7 September 2026 review; a future update should verify the current sanctions schedule directly from Law 1581 and SIC regulations before publication.
Private right of action: Article 16 requires exhaustion of the controller/processor consultation or claim process before an SIC complaint may be filed. The SIC publishes a current online Personal Data Complaints service and PQRSF route for that purpose, without a confirmed guarantee of a favorable outcome.
Relevance to data brokers
No Colombia-specific data-broker route has been confirmed in the 7 September 2026 review. A broker processing general personal data may be subject to Law 1581's consultation/claim/SIC-complaint framework; financial or credit information can also invoke Law 1266's special regime, while mixed-purpose processing may bring both regimes into view. The applicable framework depends on the data, purpose, and provider role.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What is the difference between Law 1581 and Law 1266 in Colombia?+
Law 1581 of 2012 is Colombia's general personal-data-protection statute, subject to its exclusions and special-regime boundaries. Law 1266 of 2008 is a separate, earlier statute specifically governing financial habeas data — including credit, commercial, and services information. Law 1581 principles can still apply within the statutory limits, and mixed-purpose databases may be subject to both regimes.
Do I have to contact the company before complaining to the SIC?+
Yes. Article 16 of Law 1581 requires exhausting the controller or processor's consultation or claim process — with statutory response deadlines of 10 business days for a consultation and 15 business days for a claim — before filing a complaint with the SIC's Personal Data Protection Delegation.
Official sources & citations
- Ley 1581 de 2012 (Función Pública, official text)
- SIC Delegatura para la Protección de Datos Personales
- SIC online complaints (PQRSF) service
- SIC: complaints about habeas data and personal-data protection
- SIC: mixed-purpose databases can fall under Laws 1266 and 1581
- SIC: investigation procedure for possible personal-data violations (version effective 30 April 2026)
Other international privacy regimes
Law 1581 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: