Personal Data Processing Consent Colombia (Autorización de Tratamiento de Datos Personales)

A Personal Data Processing Consent Colombia (Autorización de Tratamiento de Datos Personales) is the formal written document through which a titular (data subject — the natural person whose data is being processed) grants voluntary, specific, informed, and unambiguous authorisation to a responsable del tratamiento (data controller) and/or an encargado del tratamiento (data processor) to collect, store, use, circulate, update, correct, delete, or transfer their personal data for specified purposes, in compliance with Ley 1581 de 2012 (Ley Estatutaria de Protección de Datos Personales) — Colombia's primary data protection law — and its regulatory Decree, Decreto 1377 de 2013.

Ley 1581 de 2012 was enacted as a ley estatutaria (statutory law requiring approval by the Corte Constitucional before promulgation) — reflecting the fundamental rights nature of data protection in Colombia. The Corte Constitucional reviewed and approved the statute in Sentencia C-748 de 2011, noting that the right to habeas data — the constitutional right to know, update, and rectify information about oneself in databases — under Constitución Política Article 15 is the constitutional foundation of Colombia's data protection regime.

The SIC (Superintendencia de Industria y Comercio) — designated as Colombia's national data protection authority by Ley 1581 de 2012 Article 19 — administers the Registro Nacional de Bases de Datos (RNBD) where organisations processing personal data of Colombian citizens must register, enforces compliance through its Delegatura para la Protección de Datos Personales, and can impose administrative sanctions including fines of up to 2,000 SMMLV (salarios mínimos mensuales legales vigentes) under Ley 1581 de 2012 Article 23.

Ley 1581 de 2012 distinguishes between datos personales (personal data — any information that allows or could allow identifying a natural person) and datos sensibles (sensitive data — race/ethnicity, political opinions, religious beliefs, health data, sexual life, biometric data, and trade union membership). Under Ley 1581 de 2012 Article 6, processing of sensitive data requires: explicit and prior consent (consentimiento expreso y previo); it is optional — the data subject may refuse without negative consequences unless processing is required by law; and the purpose of the processing must be identified.

Ley 1266 de 2008 (Ley de Habeas Data Financiero) complements Ley 1581 de 2012 for financial data (datos financieros, crediticios, comerciales, and de servicios) — the credit reporting and financial database framework administered by credit bureaus (centrales de riesgo) such as DataCrédito Experian, TransUnion Colombia, and CIFIN (now Experian). Ley 1266 de 2008 grants Colombians the right to access, update, rectify, and — in limited circumstances — delete their credit information from these databases.

Colombia's data protection framework aligns broadly with the European Union's General Data Protection Regulation (GDPR) principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. The SIC participates in the Global Privacy Assembly and has signed bilateral data sharing agreements with the EU's Article 93 Committee, facilitating international data transfers under adequacy frameworks. Decree 1074 de 2015 (Decreto Único Reglamentario del Sector Comercio, Industria y Turismo) consolidates data protection regulations including those from Decreto 1377 de 2013 within the unified regulatory framework.

A Personal Data Processing Consent Colombia is required whenever an organisation — company, NGO, government entity, or individual acting as a data controller — collects or processes the personal data of Colombian residents for any purpose beyond the purely personal or domestic. Ley 1581 de 2012 Article 9 requires prior, express, and informed authorisation from the titular before processing begins.

Customer databases and CRM systems: Every Colombian company that collects customer personal data — name, email, telephone, address, purchase history, preferences — for commercial communications, customer relationship management, or marketing purposes must obtain written authorisation from each customer. The SIC has taken enforcement action against companies conducting email marketing or SMS campaigns without documented customer consent.

Human resources and employment: Employers in Colombia must obtain written data processing authorisation from job applicants and employees for the processing of their personal data — including background check data, health information for occupational health purposes (salud ocupacional under Decreto 1072 de 2015), salary information, and performance records. The authorisation must be obtained before or at the time of data collection, not retroactively.

Financial services and credit: Banks, insurers, leasing companies, and cooperativas de ahorro supervised by the Superintendencia Financiera de Colombia (SFC) must obtain authorisation for collecting and reporting credit history to centrales de riesgo (credit bureaus) under Ley 1266 de 2008, including DataCrédito Experian and TransUnion Colombia.

Healthcare and clinical data: Healthcare institutions (IPS, hospitals, clínicas, centros médicos) must obtain authorisation for processing health data (datos de salud) as datos sensibles under Ley 1581 de 2012 Article 6, including the history of illnesses, treatments, medications, and clinical records maintained in the historia clínica. Under Resolución 1995 de 1999 of the Ministerio de Salud, the historia clínica is a protected personal data record retained for 20 years.

E-commerce and online services: Websites and mobile applications serving Colombian users must display a privacy policy (política de privacidad y tratamiento de datos personales) complying with Ley 1581 de 2012, and must obtain explicit consent before collecting cookies, registration data, or user behaviour data — particularly for commercial profiling.

Educational institutions: Schools, universities, and educational platforms (including e-learning platforms) must obtain parental or guardian consent for processing minor students' data under Ley 1098 de 2006 Article 7 and Ley 1581 de 2012 — given that minors' data is specially protected.

A valid Personal Data Processing Consent Colombia under Ley 1581 de 2012 and Decreto 1377 de 2013 must contain the following essential elements to be legally effective and compliant with SIC requirements.

Identification of the Responsable del Tratamiento (Data Controller): Full legal name or razón social, NIT (company tax identification number), registered address (domicilio), and contact information — telephone, email, and data protection officer contact (delegado de protección de datos or contact person for habeas data requests). The responsable is the entity that determines the purposes and means of processing.

Identification of the Titular (Data Subject): Full name and identification number (cédula de ciudadanía, NIT, or cédula de extranjería) of the person providing consent. For minors, the parent or legal guardian's identification is required under Ley 1098 de 2006.

Data Categories to be Processed (Categorías de Datos a Tratar): Explicit listing of the categories of personal data to be collected and processed — contact data (datos de contacto: name, telephone, address, email); identification data (datos de identificación: cédula, NIT, passport); financial data (datos financieros: income, credit history, bank account); health data (datos de salud — classified as datos sensibles under Ley 1581 de 2012 Article 5); biometric data (datos biométricos — classified as datos sensibles — fingerprints, facial images); location data (datos de ubicación); and any other specific category. For datos sensibles, the form must explicitly identify them and note their voluntary nature.

Purposes of Processing (Finalidades del Tratamiento): Specific, explicit description of each purpose for which the data will be processed under Decreto 1377 de 2013 Article 5. General or vague purpose statements — "for company purposes" or "to improve our services" — are not compliant with Ley 1581 de 2012's specificity requirement. Examples of compliant specific purposes: (1) send commercial and promotional communications about the company's products and services; (2) process purchase orders and manage the commercial relationship; (3) report payment behaviour to credit bureaus (centrales de riesgo) under Ley 1266 de 2008; (4) comply with legal and regulatory obligations; (5) conduct market research and satisfaction surveys.

Data Sharing and International Transfers (Transferencia y Transmisión de Datos): If personal data will be shared with third parties (encargados del tratamiento) or transferred to recipients outside Colombia (transferencia internacional de datos), this must be explicitly disclosed. International transfers to countries without adequate data protection are subject to the SIC's authorisation requirement under Ley 1581 de 2012 Article 26, unless the recipient provides adequate protection through a data transfer agreement (cláusulas contractuales tipo).

Retention Period (Período de Conservación): The period for which personal data will be retained. Under Ley 1581 de 2012, data should be retained only for as long as necessary for the identified purposes — specific retention periods must be stated (for example: 5 years after the commercial relationship ends; for credit data, up to 4 years from payment of the obligation under Ley 1266 de 2008).

Habeas Data Rights (Derechos del Titular): Explicit notification of the titular's rights under Ley 1581 de 2012 Article 8: (a) access their personal data free of charge at any time; (b) update and correct inaccurate data; (c) request deletion of data that violates rights or is no longer necessary; (d) revoke consent at any time; (e) file complaints with the SIC; and (f) be informed of the use of their data. The contact channel for exercising these rights must be specified.

Voluntary Nature of Sensitive Data Consent: Explicit statement that providing sensitive data (datos sensibles — health, biometric, political, religious, racial, or sexual data) is voluntary and that refusal to provide it will not affect access to the company's products or services unless the data is legally required for the specific service.

Signature and Date: Titular's signature (or digital acceptance for electronic consent) and date. For electronic or online consent, Ley 527 de 1999 (Ley de Comercio Electrónico) governs the legal validity of digital signatures and electronic consent mechanisms.

Forms-legal.com provides this Personal Data Processing Consent Colombia as a practical template. Every organisation processing personal data of Colombian residents must register their databases in the SIC's Registro Nacional de Bases de Datos (RNBD) at www.sic.gov.co, maintain a written data treatment policy (política de tratamiento de datos personales), and designate a data protection contact person for habeas data requests.