The Colombian framework for AI and personal data
Colombia has one of the most mature data protection frameworks in Latin America, with Statutory Law 1581 of 2012 as its cornerstone. This law, complemented by Decree 1074 of 2015 (the Single Regulatory Decree for the Commerce Sector), applies to all processing of personal data on Colombian territory, including processing carried out by artificial intelligence systems.
The Superintendence of Industry and Commerce (SIC) published External Circular 2 of 21 August 2024, Guidelines on the Processing of Personal Data in Artificial Intelligence Systems, which constitutes the most important technical and legal reference for Colombian organisations that use or develop AI. This circular establishes guidelines on the legal bases for processing, the rights of data subjects in relation to automated decisions, and standards of security and transparency.
Habeas data in the face of AI
Habeas data is a fundamental right in Colombia, enshrined in Article 15 of the Constitution. In the context of AI, this right allows any person to know what personal data an organisation holds about them (including data used in AI systems), to update and rectify that information, to request proof of the consent given for the processing, and in some cases to object to the automated processing of their data. The SIC can sanction organisations that fail to respect these rights with fines of up to 2,000 current legal monthly minimum wages.
