Colombia Habeas Data Law 1581

Colombia

20 domains

33 controls

Colombia Statutory Law 1581 of 2012 + Decree 1377/2013 + Decree 1074/2015.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (20)

Access Control

1 controls

Controls in the Access Control domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-ART4-RESTRICTED-ACCESS	Restricted Access and Circulation	Processing is subject to the limits derived from the nature of the data and constitutional provisions. Data may only be...

Accountability

4 controls

Controls in the Accountability domain of Colombia Habeas Data Law 1581 — 4 controls
Code	Title	Description
CO-1581-ACCOUNTABILITY	Accountability Principle (Demostrar Conducta)	Controllers must adopt useful, appropriate, effective and demonstrable measures to comply with the law (accountability o...
CO-1581-ART17-CONTROLLER	Controller Duties	Controllers must guarantee data subject rights, request and keep authorisation, inform subjects of purposes, maintain qu...
CO-1581-ART18-PROCESSOR	Processor (Encargado) Duties	Processors must guarantee data subject rights, safeguard data security and confidentiality, update and correct data, pro...
CO-1581-ART25-MANUAL	Internal Policies and Procedures Manual	Controllers must adopt an internal manual of policies and procedures to guarantee compliance with the law, especially fo...

Classification

1 controls

Controls in the Classification domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-PUBLIC-DATA	Public Data Classification	Public data is data classified as such by mandate of law or the Constitution that is not semi-private, private or sensit...

Consent

1 controls

Controls in the Consent domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-ART9-AUTH	Authorisation Requirements	Authorisation must be obtained prior to processing in a way that allows it to be subsequently consulted. The controller...

Cross-Border Transfer

1 controls

Controls in the Cross-Border Transfer domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-ART26-XBORDER	Cross-Border Data Transfer Prohibition	Transfer of personal data to countries that do not provide adequate levels of protection is prohibited. SIC publishes li...

Data Lifecycle

1 controls

Controls in the Data Lifecycle domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-RETENTION	Retention and Deletion	Data must be kept only for the time necessary to fulfil the purposes that justified its processing, considering the spec...

Data Subject Rights

5 controls

Controls in the Data Subject Rights domain of Colombia Habeas Data Law 1581 — 5 controls
Code	Title	Description
CO-1581-ART13-PROC-RIGHTS	Persons Authorised to Exercise Rights	Rights may be exercised by: the data subject, successors upon proof, representative or proxy with power of attorney, or...
CO-1581-ART14-CONSULTAS	Consultations (Access Requests)	Consultations must be answered within ten (10) business days. If not possible, the data subject must be informed within...
CO-1581-ART15-RECLAMOS	Complaints (Reclamos) Handling	Complaints for correction, update, deletion or breach must be received with proof. Term to resolve is fifteen (15) busin...
CO-1581-ART8-RIGHTS	Data Subject Rights (Habeas Data)	Data subjects have the right to know, update and correct their data, request proof of authorisation, be informed of use,...
CO-1581-REVOKE	Right to Revoke Authorisation and Delete	Data subjects may revoke authorisation and request deletion at any time when processing does not respect constitutional...

Enforcement

1 controls

Controls in the Enforcement domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-ART23-SANCTIONS	Sanctions and Penalties	SIC may impose: fines up to 2,000 monthly minimum legal wages (SMLMV), suspension of activities up to 6 months, temporar...

Governance

1 controls

Controls in the Governance domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-OFFICER	Data Protection Officer Designation	Controllers must designate a person or area responsible for personal data protection who will channel data subject reque...

HR Security

1 controls

Controls in the HR Security domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-TRAINING	Personnel Training	Personnel handling personal data must be trained in data protection obligations under Colombian law as part of demonstra...

Incident Response

1 controls

Controls in the Incident Response domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-BREACH	Security Incident Notification to SIC	Controllers must inform SIC of security violations affecting personal data when there are risks in the administration of...

Lawful Basis

2 controls

Controls in the Lawful Basis domain of Colombia Habeas Data Law 1581 — 2 controls
Code	Title	Description
CO-1581-ART10-EXCEPTIONS	Exceptions to Authorisation	Authorisation is not required when: requested by public entity in exercise of legal functions or court order, public dat...
CO-1581-ART4-FREEDOM	Principle of Freedom (Consent)	Processing requires prior, express and informed consent of the data subject, except in cases listed in Article 10.

Notice

2 controls

Controls in the Notice domain of Colombia Habeas Data Law 1581 — 2 controls
Code	Title	Description
CO-1581-ART12-NOTICE	Privacy Notice at Collection	At time of authorisation, the data subject must be informed of: data being processed, purpose, optional character of ans...
CO-1581-ART4-TRANSPARENCY	Principle of Transparency	Data subjects have the right to obtain at any time and without restriction information about their data held by the cont...

Principles

3 controls

Controls in the Principles domain of Colombia Habeas Data Law 1581 — 3 controls
Code	Title	Description
CO-1581-ART4-LEGALITY	Principle of Legality	Personal data processing must be a regulated activity carried out in strict compliance with Statutory Law 1581/2012 and...
CO-1581-ART4-PURPOSE	Purpose Limitation Principle	Processing must serve a legitimate purpose under the Constitution and law, informed to the data subject at collection.
CO-1581-ART4-TRUTH-QUALITY	Truthfulness and Quality Principle	Data must be truthful, complete, exact, updated, verifiable and understandable. Partial or misleading data is prohibited...

Registration

1 controls

Controls in the Registration domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-RNBD	National Database Registry (RNBD)	Controllers must register their databases with the SIC National Database Registry (RNBD) and update annually (Feb to Mar...

Regulatory

1 controls

Controls in the Regulatory domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-ART19-SIC	SIC Supervisory Authority	The Superintendencia de Industria y Comercio (SIC), through the Deputy Superintendency for Personal Data Protection, is...

Security

2 controls

Controls in the Security domain of Colombia Habeas Data Law 1581 — 2 controls
Code	Title	Description
CO-1581-ART4-CONFIDENTIALITY	Principle of Confidentiality	All persons who intervene in the processing of personal data that is not public are obliged to guarantee the confidentia...
CO-1581-ART4-SECURITY	Principle of Security	The controller and processor must handle the data using the technical, human and administrative measures necessary to gr...

Sensitive Data

2 controls

Controls in the Sensitive Data domain of Colombia Habeas Data Law 1581 — 2 controls
Code	Title	Description
CO-1581-ART5-SENSITIVE	Sensitive Data Definition	Sensitive data includes data affecting privacy or potential discrimination: racial or ethnic origin, political orientati...
CO-1581-ART6-SENSITIVE-PROC	Sensitive Data Processing Prohibition and Exceptions	Processing of sensitive data is prohibited except: explicit authorisation, protection of vital interests, processing by...

Special Categories

1 controls

Controls in the Special Categories domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-ART7-CHILDREN	Children and Adolescents Data	Processing of data of children and adolescents is prohibited except where it responds to and respects the best interests...

Vendor Management

1 controls

Controls in the Vendor Management domain of Colombia Habeas Data Law 1581 — 1 controls
Code	Title	Description
CO-1581-VENDOR	Transmission vs Transfer Distinction	Transmission (to processor for processing on behalf) and transfer (to another controller) are distinct. Transmission to...

Frequently Asked Questions

What is Colombia Habeas Data Law 1581?

Colombia Habeas Data Law 1581 is a compliance framework from Colombia with 20 domains and 33 controls. Colombia Statutory Law 1581 of 2012 + Decree 1377/2013 + Decree 1074/2015. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Colombia Habeas Data Law 1581 have?

Colombia Habeas Data Law 1581 has 33 controls organised across 20 domains. The largest domains are Data Subject Rights (5 controls), Accountability (4 controls), Principles (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Colombia Habeas Data Law 1581 map to?

Colombia Habeas Data Law 1581 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Colombia Habeas Data Law 1581 compliance?

Start your Colombia Habeas Data Law 1581 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Colombia Habeas Data Law 1581 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.

Get Started Free →

Free forever — no credit card required