Colombia's Law 1581 of 2012 (habeas data): practical guide for SMEs in Colombia

If your company stores names, phone numbers, emails, or documents of customers, employees, or suppliers, you are already handling personal data and must comply with Colombia's Law 1581 of 2012. Many small and medium-sized enterprises (SMEs) ignore this until they receive a complaint or a fine. This guide explains in simple language what the Law 1581 of 2012 (also known as the Habeas Data Law) says, what obligations you have, and how to get up to date step by step.

Note: This article is for informational purposes only and does not replace the advice of a lawyer. Always check the current regulations and criteria of the Superintendence of Industry and Commerce (SIC).

What is Law 1581 of 2012?

It is the general law of personal data protection in Colombia. It develops the constitutional right that all individuals have to know, update, and rectify the information that has been collected about them in databases.

It is regulated by other norms, such as Decree 1377 of 2013, now compiled in Decree 1074 of 2015. The authority that oversees its compliance is the Superintendence of Industry and Commerce (SIC).

Who does it apply to?

Almost any person or company that collects, stores, uses, or circulates personal data of natural persons in Colombia: stores, clinics, restaurants, real estate agencies, academies, agencies, consulting firms, service companies, online stores, and many more.

If you have a customer list in Excel, a form on your website, a WhatsApp group with buyers, or an employee database, the law applies to you.

Key concepts

• Personal data: any information that identifies or can identify a person (name, ID, phone, email, address, photograph).
• Sensitive data: data that affects intimacy or can generate discrimination, such as health, racial origin, political or religious orientation, sexual life, and biometric data. It has stricter rules.
• Data owner: the person to whom the data belongs.
• Data processing manager: the person who decides how and why the data is used (usually, your company).
• Data processing agent: the person who processes the data on behalf of the manager (for example, a software or email provider).
• Data processing: any operation on the data: collecting, storing, using, sharing, deleting.

The principles you must respect

The law is based on several principles. The most practical ones for an SME are:

• Purpose: you use the data only for the purpose you informed.
• Freedom: you need the prior, express, and informed consent of the person.
• Veracity: the data must be accurate and up-to-date.
• Transparency: the person can know at any time what data you have about them.
• Restricted access and circulation: only those who need to use the data have access.
• Security: you protect the information against loss, unauthorized access, or misuse.
• Confidentiality: those involved in the processing keep confidentiality.

Authorization: the first step

Before collecting data, you need the owner's authorization. It must be prior, express, and informed. In practice, it means telling the person, clearly:

• Who you are (the identity and contact of the manager).
• What you will use their data for.
• What their rights are.
• That they are not obligated to provide sensitive data.
• Where they can consult your data processing policy.

How to obtain it in practice:

• On a web form, with a checkbox that the person marks (not pre-checked) and a link to your policy.
• In a chat conversation, with a message that explains the use and an affirmative response that you can store.
• On paper or verbally, with evidence that you can demonstrate later.

Keep the proof: when and how the authorization was given and what version of the policy was accepted.

Data processing policy

You must have a written and accessible policy (for example, on your website). It must include, among other things:

• Identification and contact information of your company.
• What data you collect and for what purposes.
• The rights of the owners.
• The area or person in charge of attending to queries and complaints.
• The procedure for exercising those rights.
• The date of entry into force and the validity of the databases.

If you change the way you process the data, update the policy.

The rights of individuals (and the deadlines for responding)

Owners can:

• Know, update, and rectify their data.
• Request proof of authorization that they gave.
• Be informed of the use that has been made of their data.
• File complaints with the SIC.
• Revoke authorization or request deletion of their data, unless there is a legal or contractual obligation to keep them.
• Access their personal data for free.

Deadlines set by law to attend to requests:

• Queries: response within a maximum of 10 business days, extendable by 5 business days if you inform in advance and explain the reason.
• Complaints: response within a maximum of 15 business days, extendable by 8 business days under the same conditions.

Define a contact email or form, and who responds. An unattended complaint is one of the most frequent causes of investigations.

National Database Registry (RNBD)

Some companies must register their databases in the RNBD, which is administered by the SIC. The obligation applies, among others, to companies and non-profit entities whose total assets exceed 100,000 UVT, and to public entities. If you are not sure if you are required to register, confirm with a lawyer or directly with the SIC, as the criteria are adjusted over time.

Although you are not required to register, you must still comply with the rest of the law's obligations.

Sensitive data and minor data

• Sensitive data: processing is prohibited, except in certain cases. Among them, when the owner gives explicit authorization and has been informed that they are not obligated to provide it. A clinic, consulting firm, or academy that collects health records or minor data must take special care.
• Data of children, adolescents, and minors: can only be processed if it responds to the best interests of the minor and their rights are respected, with the authorization of their legal representative.

Information security

The law requires "technical, human, and administrative" measures to protect the data. For an SME, the basics are:

• Unique passwords and a password manager.
• Two-step verification in email, CRM, and social networks.
• Periodic backups.
• Role-based access: each person sees only what they need.
• Computers and cell phones with passwords and updated.
• Confidentiality agreements with employees and providers.
• A procedure in case of a security incident (what to do, who to notify, and when).

We have a guide with concrete measures: cybersecurity for SMEs in Colombia.

If a security incident occurs that affects personal data, there are reporting rules to the SIC with short deadlines. Consult them with a professional or on the superintendence's website at the time of acting.

Providers, cloud, and data transfer to other countries

When you use cloud services (email, CRM, storage, messaging tools), these providers process data on your behalf, i.e., they act as data processing agents. Try to:

• Review their privacy and security terms.
• Have a contract or agreement that sets their confidentiality and security obligations.
• Inform in your policy that you use providers and that some may be in other countries.

If the data is transferred to a country that does not offer adequate levels of protection, the law establishes specific conditions. Review with legal advice the key providers.

Sanctions

The SIC can investigate on its own or due to a complaint and, depending on the severity, impose sanctions such as fines of up to two thousand minimum legal monthly salaries, suspension of activities related to data processing, temporary or definitive closure of operations, and other measures. Beyond the money, non-compliance damages the trust of your customers.

Checklist to get up to date

1. Make an inventory: what personal data you have, where (Excel, CRM, WhatsApp, paper) and what you use it for.
2. Define responsibilities: who attends to queries and complaints.
3. Draft your data processing policy and publish it.
4. Request authorization at all your data collection points: web form, paper forms, chats.
5. Keep the proof of each authorization.
6. Review your providers and confidentiality agreements.
7. Apply basic security measures.
8. Train your team on how to handle data and what to do in case of a request.
9. Check if you need to register your databases in the RNBD.
10. Review and update everything at least once a year.

Frequently asked questions

Does a natural person with a small business need to comply with the law? Yes. The law applies to anyone who processes personal data, regardless of size. What changes is the complexity of the measures.

Can I use customer data to send them promotions? Only if the person authorized it for that purpose. They must be able to easily withdraw their consent.

Do I need authorization to use a customer's WhatsApp number? To process their data and write to them for commercial purposes, you need the authorization for use and must tell them what it's for. If they initiated the conversation for a query, you can respond to that query, but for different purposes, ask for consent.

What happens if I buy a database of contacts? It's high-risk: you must be able to demonstrate that the people authorized the processing and that the source had the right to share them. It's better to avoid it.

How long can I keep the data? Only the necessary time for the informed purpose and to fulfill legal or contractual obligations. After that, you must delete or anonymize them.

Are employee data also covered? Yes. Resume sheets, payroll data, medical exams, and other labor data require the same guarantees, with special care for sensitive data.

In summary

Complying with Law 1581 is not an impossible burden: it's about knowing what data you have, asking for clear authorization, saying what you use it for, protecting it, and responding when someone exercises their rights. Start with the inventory, policy, and form with an authorization checkbox, and add the rest. If you handle sensitive data, minor data, or large volumes, rely on a specialized lawyer.