Privacy Policy — Law 1581
We draft your personal data processing policy in compliance with Law 1581 of 2012. Protect your users, comply with the SIC, and avoid millionaire fines.
Why does your platform need a privacy policy?
In Colombia, Law 1581 of 2012 and its Regulatory Decree 1377 of 2013 establish that any company that collects, stores, uses, or circulates personal data must have a clear and accessible data processing policy.
If your digital platform has registration forms, payment gateways, user analytics, or any mechanism that captures personal information, you are required to comply. The Superintendence of Industry and Commerce (SIC) can impose fines of up to 2,000 legal monthly minimum wages.
What should your privacy policy contain?
Controller identification
Name, tax ID, address, and contact details of the company processing personal data.
Processing purposes
Why you collect data: service provision, marketing, analytics, billing, etc.
Data subject rights
Access, update, rectification, deletion, and consent revocation (ARCO rights).
Inquiry and complaint procedures
Channel and deadlines for users to exercise their rights. The law establishes 10 business days for inquiries and 15 for complaints.
Transfers and transmissions
If you share data with third parties (cloud providers, payment gateways), you must disclose this and guarantee equivalent protection.
Security measures
Technical and organizational measures to protect data against unauthorized access, loss, or alteration.
Our process
Data diagnosis
We map what personal data your platform collects, through which channels, for what purposes, and to whom it's transferred.
Policy drafting
We create a customized data processing policy in clear language, compliant with Law 1581 and Decree 1377.
Privacy notice
We design the notice presented to users when collecting their data (forms, registration, checkout).
RNBD registration
We register your databases in the SIC's National Database Registry.
Implementation
We guide you on integrating consent mechanisms, checkboxes, and links into your platform.
What does our service include?
- ✓Personal data mapping and information flows
- ✓Customized data processing policy
- ✓Privacy notice for forms and collection points
- ✓Database registration with the SIC (RNBD)
- ✓Consent clauses for your platform
- ✓Data subject inquiry and complaint response protocol
- ✓International data transfer advisory
Complementary services
The privacy policy is just one part of digital compliance:
- → Terms and conditions to regulate the use of your digital platform.
- → SaaS Contracts if you license software to third parties.
- → Company Incorporation if you haven't formalized your company yet.
Frequently Asked Questions
Yes. Law 1581 of 2012 and Decree 1377 of 2013 require any natural or legal person that collects, stores, or uses personal data to have a data processing policy. The SIC can impose fines of up to 2,000 minimum monthly wages for non-compliance.
The privacy policy is the complete document describing how you process personal data (purposes, rights, procedures). The privacy notice is a brief communication presented when collecting data, informing the data subject about the policy's existence and processing purposes.
Yes, except for legal exceptions. Consent must be prior, express, and informed. For sensitive data (health, biometrics, political orientation), reinforced consent is required and cannot be conditioned on service provision.
Yes. The SIC's National Database Registry (RNBD) requires companies to register their personal databases. We help you with the complete registration.
If you process data from EU users, you must also comply with GDPR. For users in other countries, local data protection laws apply. We help you create a policy covering multiple jurisdictions based on your operation.