In August, Bills No. 214/2025 and 274/2025 were introduced before the House of Representatives of Colombia, both proposing partial amendments to Statutory Law 1581 of 2012 (hereinafter, the “Bill” or, jointly, the “Bills”).
The first was promoted by a group of congress members aligned with the Executive Branch, while the second was drafted and submitted jointly by the Ministries of Commerce, Industry and Tourism and of Science, Technology and Innovation. The two of them will be initially reviewed by the First Permanent Constitutional Commission, which decided to consolidate them.
Both Bill 214/2025 and Bill 274/2025 introduce substantial reforms to Statutory Law 1581 in order to adapt it to current technological and social challenges. The main proposed changes include:
- Expansion of the scope of application to cover, in certain cases, controllers and processors not domiciled in Colombia, who will be required to appoint a representative in the country.
- Recognition of new legal bases for data processing, such as the performance of a contract and compliance with a legal obligation.
- Inclusion of the principle of accountability, in line with modern international standards in the field.
- Introduction of new data subject rights, including the right not to be subject to automated decisions, the right to data portability, the right to request the restriction of processing, and the right to object to processing.
- Regulation of the processing of adolescents’ data, establishing that minors aged 14 and older may provide valid consent for the processing of their personal data.
- New obligations for controllers and processors, including the designation of a data protection officer and conducting impact assessments in certain circumstances.
- Recognition of model contractual clauses as a mechanism to validate international data transfers.
Additionally, Bill No. 214 introduces specific provisions such as:
- Recognition of the legitimate interest of the controller or a third party as a legal basis for data processing.
- Incorporation of specific measures to ensure compliance with the principles of accountability and privacy by design and by default.
With regard to sanctions, both Bills provide for fines of up to 5% of the offender’s operational revenues from the previous fiscal year, as well as the definitive shutdown of operations in cases of failure to comply with corrective measures ordered by the authority. The difference lies in the second criterion used to determine the maximum amount of fines: while Bill 214/2025 sets a cap of four thousand monthly legal minimum wages (approximately USD 1,461,883), Bill 274/2025 establishes a maximum of ten thousand monthly legal minimum wages (approximately USD 3,650,000).
The full texts of Bills No. 214 and 274 can be found here and here.
