What Is Ley 1581 de 2012?
Colombia's Law 1581 of 2012 is confirmed in force per current official normative records, entering into force 17 October 2012. The Superintendencia de Industria y Comercio (SIC), through its Personal Data Protection Delegation, is the authority for the general regime. The official text supports a broad general regime for personal data in public and private databases, but it contains material exclusions and special-regime boundaries: personal/domestic processing, national-security/intelligence processing, journalistic/editorial processing, and financial habeas data governed by the separate Law 1266 regime are all excluded from the general Law 1581 framework. The current normative record states a ten-business-day consultation deadline and a fifteen-business-day claim deadline, with bounded extensions and cure rules. Article 16 requires exhaustion of the controller/processor consultation or claim process before filing an SIC complaint; the SIC publishes a current online Personal Data Complaints service and PQRSF route for that purpose.
At a glance
- Full name
- Ley 1581 de 2012
- Short code
- Law 1581
- Jurisdiction
- Colombia
- Enacted
- 2012
- Last major update
- Confirmed in force in the 7 September 2026 review; entry into force 17 October 2012
- Regulator
- Superintendencia de Industria y Comercio (SIC), Delegatura para la Protección de Datos Personales
- Private right of action
- Limited
- Statutory citation
- Ley 1581 de 2012
Scope, who Law 1581 covers
Protected data
Data subject rights
Consultation of personal data held about the data subject
Claim (rectification, updating, or deletion of data, or of a suspected legal violation)
Consultation response within 10 business days
Claim response within 15 business days, with bounded extensions and cure rules
Complaint to the SIC after exhausting the controller/processor consultation or claim process
Notable features
Colombia's regime is deliberately layered: Law 1581 provides the general personal-data framework, while financial habeas data (credit and payment-history information) is governed by the separate, earlier Law 1266 of 2008 regime — a description of Colombian data rights must not collapse these two into a single statute.
Enforcement & penalties
Regulator: Superintendencia de Industria y Comercio (SIC), Delegatura para la Protección de Datos Personales
Penalties: Not independently confirmed in the 7 September 2026 review; a future update should verify the current sanctions schedule directly from Law 1581 and SIC regulations before publication.
Private right of action: Article 16 requires exhaustion of the controller/processor consultation or claim process before an SIC complaint may be filed. The SIC publishes a current online Personal Data Complaints service and PQRSF route for that purpose, without a confirmed guarantee of a favorable outcome.
Relevance to data brokers
No Colombia-specific data-broker route has been confirmed in the 7 September 2026 review. A broker processing general personal data would ordinarily be subject to Law 1581's consultation/claim/SIC-complaint framework, while a broker handling financial or credit information would instead fall under the separate Law 1266 financial habeas data regime — the applicable framework depends on the data category involved.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
What is the difference between Law 1581 and Law 1266 in Colombia?+
Law 1581 of 2012 is Colombia's general personal-data-protection statute, covering most public and private databases. Law 1266 of 2008 is a separate, earlier statute specifically governing financial habeas data — credit and payment-history information — which is excluded from Law 1581's general regime.
Do I have to contact the company before complaining to the SIC?+
Yes. Article 16 of Law 1581 requires exhausting the controller or processor's consultation or claim process — with statutory response deadlines of 10 business days for a consultation and 15 business days for a claim — before filing a complaint with the SIC's Personal Data Protection Delegation.
Official sources & citations
Other international privacy regimes
Law 1581 sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: