On August 27, Bill No. 274/2025 was introduced before the House of Representatives of Colombia. The bill proposes partial amendments to Statutory Law 1581 of 2012 on personal data protection (hereinafter, the “Bill”).
The Bill, jointly promoted by the Ministries of Commerce, Industry and Tourism, and Science, Technology and Innovation, is currently under review by the First Permanent Constitutional Commission. Its purpose is to update the existing regulatory framework in light of current technological and social challenges. The main changes include:
- Expansion of the scope of application to cover, in certain cases, controllers and processors not domiciled in Colombia, who will be required to appoint a representative in the country.
- Recognition of new legal bases for data processing, such as the performance of a contract and compliance with a legal obligation.
- Inclusion of the principle of accountability, in line with modern international standards in the field.
- Introduction of new data subject rights, including the right not to be subject to automated decisions, the right to data portability, the right to request the restriction of processing, and the right to object to processing.
- Regulation of the processing of adolescents’ data, establishing that minors aged 14 and older may provide valid consent for the processing of their personal data, except in cases where the law expressly requires authorization from their legal representative.
- New obligations for controllers and processors, including the designation of a data protection officer and conducting impact assessments in certain circumstances.
- Recognition of model contractual clauses as a mechanism to validate international data transfers.
In terms of sanctions, the Bill provides for fines of up to ten thousand monthly minimum legal wages (approximately USD 3,650,000) or up to 5% of the offender’s operational revenues from the preceding fiscal year.
The full text of the Bill can be found here.
