Colombia Law 1581

Colombian Personal Data Protection Law - principles, data subject rights, registration, data processing.


Short name	CO 1581
Region	Americas
Country or scope	Colombia
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CO 1581

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for CO 1581.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for CO 1581 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CO-1581-4G` Security Principle	Information must be handled with the technical measures necessary to prevent adulteration, loss, or unauthorized access; integrity hashes over the software inventory demonstrate protection against adulteration (Law 1581/2012 Art. 4(g))	Scan
`CO-1581-4D` Veracity or Quality Principle	Information subject to processing must be truthful, complete, exact and up to date; applying the same bar to the processing environment means components must carry both a name and a version (Law 1581/2012 Art. 4(d))	Scan
`CO-1581-17` Controller Duties	Controllers must keep the information under the security conditions necessary to prevent its adulteration or loss and maintain records supporting processing; an enumerated component inventory of processing systems supports these duties (Law 1581/2012 Art. 17)	Scan
`CO-1581-18` Processor Duties	Processors handling data on behalf of controllers carry their own security and confidentiality duties, requiring the controller to know which suppliers stand behind the software in the processing chain (Law 1581/2012 Art. 18)	Scan
`CO-1581-25` National Registry of Databases	Databases subject to the law must be registered in the National Registry of Databases (RNBD) with identifying information; a uniquely identified, timestamped SBOM document supports registration-grade recordkeeping (Law 1581/2012 Art. 25)	Scan
`CO-1581-4E` Transparency Principle	Data subjects are entitled to obtain information about the processing concerning them at any time; interchangeable machine-readable records of the processing environment make such transparency operational (Law 1581/2012 Art. 4(e))	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CO-Art4`	Principios del Tratamiento (Art. 4)
`CO-Art8`	Derechos de los Titulares (Art. 8)
`CO-Art9`	Autorización del Titular (Art. 9)
`CO-Art17`	Deberes del Responsable (Art. 17)
`CO-Art25`	Registro Nacional de Bases de Datos (Art. 25)
`CO-Art26`	Transferencia Internacional (Art. 26)
`CO-SEC-01`	Medidas de Seguridad de la Información
`CO-POL-01`	Política de Tratamiento de Datos
`CO-ENC-01`	Cifrado en Tránsito y Reposo
`CO-DS-01`	Datos Sensibles: Restricciones
`CO-BR-01`	Reporte de Incidentes de Seguridad

Policy templates

Written for CO 1581:

Procedimiento de Notificación de Incidentes de Seguridad: LATAM

And 22 from the standard set, adapted to CO 1581.