🇨🇴Statutory Law 1581 of 2012
Statutory Law 1581 of 2012
Law 1581 applies to personal data in public and private databases, subject to its statutory exclusions. The Superintendence of Industry and Commerce (SIC) is the supervisory authority.
Core duties
Articles 4–7 establish processing principles and heightened rules for sensitive data and children. Articles 8–12 require prior informed authorization unless an exception applies and mandate specified information at collection. Articles 14–15 prescribe query and complaint workflows.
Articles 17–18 allocate detailed duties to controllers and processors. Article 25 creates the National Database Register, subject to current regulatory thresholds and SIC instructions. Articles 26–27 govern international transfers and binding corporate rules.
Decree 1074 requires documented treatment policies, proof of authorization and notice delivery, simple rights mechanisms, processor contracts, security measures and demonstrable accountability.