Ley 1581 de 2012, Cross Border Data Transfer

Ley 1581 de 2012, arts. 26-27 (Transferencia a Terceros Paises)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 17 October 2012.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not transfer personal data to a country the Superintendencia de Industria y Comercio has not found to offer an adequate level of data protection, absent a recognized exception.
Rely on the cross border transfer exceptions only where the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical exchange required for treatment or public health, a banking or securities transfer under its own law, a transfer under a reciprocal international treaty Colombia has joined, a transfer necessary to perform a contract with the data subject, or a transfer legally required to safeguard the public interest or defend a right in a judicial proceeding.
Where none of the listed exceptions applies, obtain the Superintendencia de Industria y Comercio's declaration of conformity before transferring personal data internationally.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 26 prohibits transferring personal data of any kind to a country that does not provide an adequate level of data protection, measured by standards the Superintendencia de Industria y Comercio sets and that may never fall below this law's own requirements, unless the data subject has given express and unequivocal authorization for the transfer, the transfer is a medical data exchange required for the data subject's health treatment or public hygiene, the transfer is a banking or securities transfer under its own applicable law, the transfer is agreed under an international treaty Colombia has joined on a reciprocity basis, the transfer is necessary to perform a contract with the data subject or precontractual measures the data subject has authorized, or the transfer is legally required to safeguard the public interest or to establish, exercise or defend a right in a judicial proceeding, and requires the Superintendencia's declaration of conformity before any transfer outside those exceptions.

Article 27 requires the National Government to regulate Binding Corporate Rules certifying good personal data protection practices for a transfer to a third country.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Official consolidated text, Gestor Normativo, Departamento Administrativo de la Funcion Publica

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app