Protección de datos personales Colombia: Ley 1581 for dataset licensing

Does Colombia's data protection law apply to your records?#

Probably, if the records were collected or processed in Colombia, even when your company is headquartered elsewhere. Ley 1581 de 2012 applies to processing carried out in Colombian territory, and also to a Responsable or Encargado not established in Colombia when Colombian law applies to it under international norms or treaties.

The law covers personal data, defined as any information linked to, or that can be associated with, one or more identified or identifiable natural people. That covers the usual operational sources: CRM contacts and notes, contact-center recordings and transcripts, support tickets in Zendesk or Jira Service Management, HR files, delivery addresses and survey responses collected from people in Colombia.

Typical ways a U.S., Canadian or EU company ends up holding these records: a Colombian subsidiary, a contact center or BPO operation in Bogotá or Medellín, customers or survey panels in Colombia, or field teams there. Each is a different fact pattern, so map where the records were collected, by which entity, and under which privacy notice before anything else.

Which Colombian rules matter for a dataset license?#

Four layers matter: the statute, the implementing decree, the SIC's circulars and concepts, and your own authorization records. The table lists what each one decides for a license.

• 1The Superintendencia de Industria y Comercio (SIC) is the data protection authority, acting through a Delegatura for personal data protection (Article 19).
• 2The SIC can fine private parties up to 2,000 monthly legal minimum wages, repeatable while the breach continues, and can order the closure of operations that process sensitive data (Article 23).
• 3The SIC issued Circular Externa 002 of August 21, 2024 with guidelines on personal data in AI systems; have counsel apply it to your specific project.

Does the original authorization cover licensing for AI training?#

Usually not, unless the authorization named that purpose. Article 9 requires prior, informed authorization from the titular (the person the data is about), and Article 4 requires a legitimate purpose that is told to the titular. The SIC has said that using data for a purpose other than the one authorized needs a new express authorization, and that a substantial change in purpose must be communicated and reauthorized.

Article 10 lists, as a closed list, when authorization is not needed: information required by a public or administrative entity in its legal functions or by court order, data of a public nature, medical or health emergencies, processing authorized by law for historical, statistical or scientific purposes, and civil registry data. A commercial dataset license does not fit neatly into any of these, so do not assume one applies without counsel's written view.

Sensitive data, such as health, sex life and biometric data, is prohibited from processing except under listed exceptions, chief among them the titular's explicit authorization (Articles 5 and 6). Plan to exclude sensitive fields unless explicit authorization for this use exists.

Authorization also has to be provable. Decreto 1377 requires the Responsable to request it no later than collection, stating the specific purposes, and to keep proof that can be consulted later. Use the table to sort your sources.

Are you the Responsable or the Encargado?#

Only a Responsable can decide to license; an Encargado cannot. Ley 1581 defines the Responsable as the person who, alone or with others, decides on the database or the processing, and the Encargado as the person who processes data on the Responsable's behalf.

This settles many Colombian cases quickly. A contact center or BPO that handles calls for a client is usually the Encargado for those calls: the client decides, and the BPO's contract and the client's authorization limit what it can do. A company licensing its own customer records collected by its Colombian subsidiary is closer to the Responsable position, though which group entity is the Responsable is a question for counsel.

Keep four permissions apart: system access, privacy permission, ownership and contractual licensing rights. The Colombian authorization covers only the privacy permission, and de-identification does not create a right to license on its own. The full framework is in the page on the right to license business records.

Which transfer route applies when the buyer is in the United States?#

First decide whether the delivery is a transfer or a transmission, then check the destination country. Decreto 1377 defines a transfer as sending personal data from a Responsable or Encargado in Colombia to a recipient that is itself a Responsable, and a transmission as communicating data inside or outside Colombia so that an Encargado processes it on the Responsable's behalf.

A buyer that receives a dataset to train its own models decides what to do with it, so a license delivery that still contains personal data is generally a transfer. A vendor that only de-identifies records under your instructions is generally an Encargado receiving a transmission.

Article 26 prohibits transfers to countries that do not provide adequate protection, as set by the SIC. The SIC added a chapter on international transfers to its Circular Única through Circular Externa 005 of August 10, 2017, and numeral 3.2 of that chapter lists the countries with an adequate level of protection. The September 29, 2022 version of Title V of the Circular Única still lists the United States of America there. Exceptions to the ban include express and unequivocal authorization from the titular, transfers necessary to perform a contract between the titular and the Responsable with the titular's authorization, and others for health, banking, treaties and legally required public-interest cases. Where none applies, the SIC can issue a Declaration of Conformity.

Two caveats. Being on the list removes the transfer ban, not the authorization and purpose rules in the previous sections. And the list and SIC guidance are not static: numeral 3.2 has been amended before (for example by Circular Externa 02 of March 23, 2018), and we could not verify the text in force on October 13, 2026, so check the current Title V before relying on the United States being listed. A February 25, 2026 SIC concept (25-632634) restated the standards for identifying adequate countries and the Declaration of Conformity alternative. In late 2025 the SIC also published a draft circular on model contractual clauses for transfer and transmission for public comment; we could not confirm that it was adopted, so do not assume SIC model clauses are in force. Have counsel confirm the list and any final clauses on the date of delivery.

What does the SIC expect as demonstrated accountability?#

The SIC expects the Responsable to be able to show, on request, that it has appropriate and effective measures for complying with Ley 1581 and its decree, proportionate to the nature of the data and the processing. This is the principio de responsabilidad demostrada, now found in Article 2.2.2.25.6.1 of Decreto 1074 de 2015.

For a license, accountability means you can hand counsel or the SIC a file that explains the decision. The checklist below is a practical starting point, not a statement of the SIC's minimum.

• 1Processing policy in force, and the version in force when each source was collected.
• 2Authorization evidence by source: the text shown, how it was captured, and a sample of stored records.
• 3A purpose analysis comparing the authorized purposes with dataset licensing and model training.
• 4Role analysis: which entity is Responsable, and any client contracts that make you an Encargado.
• 5Sensitive-data screen and the fields excluded.
• 6De-identification method, test results and who performed them.
• 7Transfer analysis: transfer or transmission, destination country, adequacy check date, exception or declaration relied on.
• 8The license itself: permitted use, onward transfer limits, deletion on termination, and security terms.
• 9RNBD status of the source databases and any new database the project creates.

Do you need to register the database in the RNBD?#

Only if the Responsable meets the threshold. Under Decreto 090 de 2018, registration in the Registro Nacional de Bases de Datos (RNBD) is mandatory for companies and nonprofit entities with total assets above 100,000 UVT, and for public-law legal persons.

Databases created after the original deadlines must be registered within two months of creation. The SIC also requires registered databases to be updated each year between January 2 and March 31, and substantial changes to be reported within the first ten business days of each month.

Whether a licensing extract or a staging copy counts as a new database is a fact question for counsel. A company below the threshold still has every other duty in the law; only registration is lifted.

Spanish-to-English glossary for protección de datos personales in Colombia#

Colombian counsel, buyers and the SIC use Spanish terms that do not map one to one onto GDPR or U.S. vocabulary. Use these working translations in your file and keep the Spanish term next to the English.

How this fits a licensing process#

Licensing records of people in Colombia comes down to three questions that should be answered before any data moves: is the use authorized, who is the Responsable, and which transfer route applies. If any answer is no or unclear, the usual options are to exclude those records, aggregate them, de-identify them to the point they cannot be associated with a person, or seek new authorization.

SourceX runs sourcing and qualification, rights review, contracting, data preparation, delivery and payment for businesses licensing operational data to AI developers. It works with U.S., Canadian and EU companies that had 50 or more full-time employees at their peak, so a Colombian dataset usually arrives through such a company's subsidiary, contact center or customer base. The company approves exactly what is released, once per deal, and de-identification is performed by SourceX directly or through its processing partner.

None of that replaces Colombian counsel's view of authorization and transfer for your specific records. The first step is a short company assessment, and no data uploads are needed to see if a company qualifies.