Colombia's data protection framework — Law 1581 of 2012 and its implementing decrees — is more than a decade old. In 2026 two topics dominate the debate: a government bill to modernise the law, and the use of personal data in artificial intelligence. Both were central themes at the Superintendence of Industry and Commerce's (SIC) 13th International Data Protection Congress in July 2026.
The Reform Bill: Key Proposals
In August 2025 the government filed a statutory bill to partially amend Law 1581. According to the SIC, the main proposals are:
- Wider territorial scope: the law would apply whenever processing affects people in Colombia, wherever the controller is based
- Accountability ("responsabilidad demostrada") as an explicit principle, plus stronger transparency
- New definitions for automated processing and profiling
- More legal bases for processing beyond consent
- Children and adolescents: those over 14 could authorise processing themselves; profiling of minors that could harm their development or serves commercial purposes would be banned
- International transfers only to countries with adequate protection or with additional safeguards
- Higher fines: up to 10,000 monthly minimum wages, or an alternative or additional penalty of 5% of operating income — compared with a maximum of 2,000 minimum wages today
- Stronger authorities: broader powers for the SIC and a role for the Procuraduría in the public sector
The bill is still going through Congress and has not been passed. Its final content may change, but its direction is clear: Colombia is moving closer to GDPR-style rules.
AI and Personal Data
As of autumn 2026, Colombia has no specific AI law; several bills are pending. Until then, the SIC's position is that Law 1581 applies in full to any AI system that processes personal data. The SIC's External Circular 002 of 2024 sets out its expectations for AI, including transparency, data minimisation and impact assessment before deploying AI systems that process personal data.
What Applies Today
Until the reform is passed, the familiar obligations remain: prior, express and informed authorisation, information processing policies, handling of habeas data requests, registration of databases in the National Database Register (RNBD) for the companies that are subject to it, and reporting of security incidents to the SIC.
Your 2026 Checklist
- Review your authorisations and information processing policy
- Inventory your AI use cases and assess them against Circular 002 of 2024
- Introduce accountability now: document your processing, risks and decisions so you are ready if the reform passes
- Check international transfers and the safeguards in your vendor contracts
- Keep your RNBD registration up to date
How ResGuard Can Help
The ResGuard Data Protection Manager documents your processing activities, authorisations, requests and incidents in one place, in Spanish. Our outsourced DPO service for Colombia supports you with the current rules and the upcoming reform.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: SIC publications on the reform bill and its 2026 congress, and published commentary on the legislative process.