GRCLibrary.ai

Annex

Colombia Privacy Regulatory Requirements

This annex defines the privacy regulatory requirements applicable to the tratamiento (processing) of personal data in Colombia under Ley Estatutaria 1581 de 2012 and its reglamentary stack, principally Decreto 1377 de 2013 as compiled into the Decreto Único Reglamentario 1074 de 2015 (Capítulo 25), together with the Registro Nacional de Bases de Datos rules (Capítulo 26, compiling Decreto 886 de 2014 as modified by Decreto 90 de 2018) and the Normas Corporativas Vinculantes rules (Sección 7, added by Decreto 255 de 2022). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure. Ley 1581 applies to personal data registered in any database that makes them susceptible to tratamiento by public- or private-nature entities, to tratamiento carried out in Colombian territory, and to a controller or processor not established in Colombia where Colombian law applies to it by virtue of international norms and treaties [Ley Art 2].

Type
Annex
Version
0.0.2
Date
2026-09-04
Owner
Data Protection Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Privacy
Review frequency
Annual and upon material privacy or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Applicable law and regulatory authority
  • Principles, lawful basis, and authorization
  • Data-subject rights
  • Cross-border transfers
  • Database registration and accountability
  • Security and breach
  • Enforcement and penalties
  • Employment and workforce monitoring
  • Limitations

Related documents