Colombia

Article 1 develops the constitutional right, under article 15 of the 1991 Constitution, of every person to know, update and rectify information collected about them in a database, and article 2 applies the law to personal data registered in any database made susceptible to processing by a public or private entity.

Article 9 requires the data controller to obtain the data subject's prior and informed authorization before processing their data, and article 4 sets the governing principles, including legality, purpose limitation, and security.

Article 5 defines sensitive data as data that affects a person's privacy or whose misuse can generate discrimination, expressly naming racial or ethnic origin, political opinion, religious or philosophical belief, union or human-rights-organization membership, health, sexual life, and biometric data, and article 6 prohibits processing sensitive data unless the data subject gives explicit authorization or a narrow statutory exception applies.

Articles 14 to 16 give the data subject rights to consult and to lodge a claim for correction, updating, or deletion with the controller, escalable to the Superintendencia de Industria y Comercio (SIC) once that internal process is exhausted.

Article 23 authorizes the SIC to impose administrative fines of up to 2,000 monthly legal minimum wages, suspend the processing activity for up to six months, or order the immediate and permanent closure of an operation involving sensitive data; the sanctions provided are purely administrative and the law does not create a criminal offense.

Article 26 prohibits transferring personal data of any kind to a country that does not provide an adequate level of data protection, as determined by SIC standards, subject to exceptions including the data subject's express consent and international cooperation exchanges.

The SIC's Circular Externa No. 002 de 2024 instructs every data controller and processor subject to Ley 1581 de 2012 and Ley 1266 de 2008 on how those technology-neutral statutes apply to developing, deploying, or using an artificial intelligence system that processes personal data.

It states that personal data being accessible on the internet does not make it data of a public nature, so a controller that collects personal, semi-private, or sensitive data online is not thereby entitled to treat it for an AI system's purposes without the data subject's prior, express and informed authorization.

It requires a documented privacy impact assessment before an AI system likely to pose a high risk to data subjects processes their personal data, requires privacy-by-design measures such as differential privacy so that training data cannot identify the person who provided it, and requires that a data subject be able to obtain, at any time and without restriction, information about how an AI system is processing their personal data.

Article 269A punishes whoever, without authorization or beyond what was agreed, accesses in whole or part a computer system protected or not by a security measure, or remains within it against the will of the person entitled to exclude them, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.

Because the article expressly covers a system whether or not it is protected by a security measure, its authorization test does not, on its plain text, require defeating a technical access control the way jurisdictions that condition the offense on infringing a security measure do.

Article 12, as rewritten by article 3 of Ley 1915 de 2018, gives the author the exclusive right to authorize or prohibit reproduction of the work by any means or form, permanent or temporary, including temporary electronic storage, as well as communication to the public, distribution, importation, commercial rental, and transformation.

Ley 23 de 1982 creates no text-and-data-mining exception and no machine-readable opt-out mechanism; its narrow enumerated exceptions (quotation with attribution, illustration for non-commercial teaching, single-copy reproduction for private non-commercial use) do not create a general ground for reproducing copyrighted text to train a model.

Colombian copyright law confers no sui generis database right; a compilation is protected only as a collective work for eighty years from publication in favor of its director, under article 24.

Article 269F punishes whoever, without authorization and for their own or a third party's benefit, obtains, compiles, extracts, offers, sells, exchanges, sends, buys, intercepts, discloses, modifies, or uses personal codes or personal data contained in files, archives, databases, or similar media, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.

Scraping personal data without the controller's authorization can independently expose the scraper to this criminal offense, on top of the administrative duties Ley 1581 de 2012 imposes on the processing itself; the Superintendencia de Industria y Comercio's Circular Externa 002 de 2024 states that personal data being accessible on the internet does not make it data of a public nature, so Colombia's personal-data regime does not carve out publicly accessible personal data from its own reach.

Article 33 permits reproducing any title, photograph, illustration or commentary about a current event that has been published by the press or broadcast by radio or television, unless this has been expressly prohibited. Article 34 makes it lawful to reproduce, distribute, and communicate to the public news or other information about facts or events that have already been publicly disseminated by the press or broadcasting, with no authorization required.

Article 35 lets speeches, addresses, sermons and similar works delivered in public be published as current-events news in the press, by radio or by television without authorization, unless the author has expressly reserved ownership, though such works may not be published in a separate collection without the author's permission. None of the three articles caps a headline's or extract's length beyond the express-prohibition and non-collection conditions they each state.