COLOMBIA Law and Practice Contributed by: Jaime Trujillo, Juan David Velasco, Natalia Ponce de León and Angelica Navarro, Baker McKenzie S.A.S.
data collection), any company, whether local or for - eign, that collects or processes personal data from Colombian residents is subject to the provisions and obligations of Colombian data protection law. In several cases, the SIC has explicitly stated that even the act of collecting data through cookies from web or mobile browsers falls under the scope of Colombian data protection regulations. Therefore, any foreign entity engaged in online data collection from Colombian individuals must comply with local data protection laws. 8.3 Role and Authority of the Data Protection Agency The data protection authority in Colombia is the SIC. Given Colombia’s political cycle (presidential elections will be taking place in mid-2026), it is common for new administrations to promote comprehensive tax reforms at the beginning of their term. In this context, it is reasonably expected that a new tax reform may be proposed in the short term, with the objective of adjusting fiscal policy, strengthening government rev - enues and addressing structural budget needs. Reform to the General Data Protection Regulation in Colombia A bill of law is currently being discussed in the Cham - ber of Representatives, which seeks to reform and modernise the personal data protection regime in Colombia. Among other aspects, the bill proposes to: • incorporate a new legal basis for the processing of personal data, such as the performance of a con - tract or compliance with a legal obligation; • expand the definition of sensitive personal data to include geolocation data, genetic data and neuro - data; • reduce the deadline for reporting security incidents or data breaches from 15 business days to 72 hours; and 9. Looking Forward 9.1 Upcoming Legal Reforms Tax Reform
• establish the obligation for controllers or proces - sors operating on a large scale to enable a contact channel and appoint a representative before the SIC. Consumer Protection Legislative Outlook A bill of law proposes a comprehensive reform of Colombia’s Consumer Protection Statute. The bill aims to modernise and strengthen consumer rights across both traditional and digital markets. Key proposals include: • empowering local authorities to impose sanctions; • requiring transparency in credit offers (eg, disclos - ing the annual cost of financing); • mandating the display of product reparability indexes; and • prohibiting tied sales, deceptive environmental claims (greenwashing) and discriminatory profiling in customer service. Technology Colombia continues to move towards AI regulation through ongoing legislative initiatives. In July 2025, the government introduced a new AI bill establish - ing a risk-based regulatory framework, aligned with international standards. The bill includes specific IP implications, notably: • AI developers must obtain explicit authorisation to use protected works, images or voices for training models; and • exceptions may apply only under limited legal grounds, subject to case-by-case assessment. The proposed system also introduces sanctions (fines and operational suspensions) for misuse of AI sys - tems, reinforcing compliance obligations for compa - nies. These developments reflect a broader shift from policy-oriented governance towards binding regula - tory controls, especially concerning data use, training practices and IP protection. In parallel, the Colombian Criminal Code was amend - ed to classify AI-driven impersonation, such as deep - fakes, as an aggravated offence. The amendment will
228 CHAMBERS.COM
Powered by FlippingBook