On January 5, 2026, Colombia’s Superintendence of Industry and Commerce (“SIC”) issued External Circular No. 003/2025 (the “Circular”), approving the use of the model contractual clauses of the Ibero-American Data Protection Network (“RIPD”) as a mechanism to validate international transfers and transmissions of personal data.
Law No. 1581 of 2012, which governs personal data protection in Colombia, only allows international transfers of personal data to countries that do not benefit from an adequacy decision in limited cases, such as with the data subject’s consent or if the transfer is necessary for the performance of the contract between them and the controller.
According to the Circular, the model clauses may be adopted with modifications, provided that such changes do not undermine the safeguards established therein or under Law No. 1581. In line with this approach, the Circular further clarifies that concepts, mechanisms, or deadlines included in the RIPD clauses that are not expressly recognized under the Colombian data protection regime will nonetheless be considered valid, as long as they do not have a negative effect on data subject protections or the obligations imposed by Law No. 1581 and its implementing regulations. By way of example, if the clauses establish a shorter deadline for security incident notification than that set forth under Law No. 1581, such deadline will be deemed valid.
This measure aligns Colombia with prevailing regional trends, as several countries, including Argentina, Chile, Ecuador, Peru, and Uruguay, have already adopted these clauses. Their implementation positions Colombia within a more integrated regional ecosystem, where international data transfers play a central role in the global digital economy.
