Guide · Personal data
Colombia's Law 1581 for websites: what your site needs.
If your website has a form, a WhatsApp button, an AI assistant or Google Analytics, it collects personal data. Here's what Colombian law expects you to have, explained without jargon.
Updated .
In one sentence
Law 1581 of 2012 regulates how personal data is collected, used and stored in Colombia. For a website, it comes down to three things: saying what you use the data for, asking for consent before collecting it and responding when someone asks to see, correct or delete it.
This is not legal advice. It's a practical guide to understanding what your website needs. A lawyer should review the text of your data policy and your company's specific cases.
01 The minimum
Six things your website must have.
None of them is hard to implement. The hard part is finding out they were missing when someone files a complaint.
-
01
Data processing policy
A published document stating who the data controller is, what data you collect, what you use it for, what rights the data subject has, through which channel to exercise them and when it takes effect.
-
02
Consent on every form
An unchecked box next to the submit button, with a link to the policy. Consent must be prior, express and informed: no pre-checked boxes.
-
03
Ask only for what you need
If a name and WhatsApp number are enough for a quote, don't ask for an ID number, address or date of birth. Every extra piece of data is extra risk.
-
04
Cookie notice with consent
Say which cookies you use and ask permission before turning on analytics or advertising cookies, with rejecting them as easy as accepting.
-
05
A channel to exercise rights
An email address or form where people can request access, updates, corrections or deletion of their data, and someone responsible for replying on time.
-
06
Careful with sensitive data
Health, biometrics, political or religious views and data about minors have stricter rules. If your business needs them, ask for them only with express consent.
02 Where it shows up
Where your website collects data without you noticing.
It's not just the contact form. Check every item on this list on your site.
- Forms
Contact, quote, newsletter and resource downloads. They all need their consent box.
- WhatsApp and chat
An AI assistant or a chat receives names, phone numbers and whatever the person writes. It should notify them and link to the policy before starting.
- Analytics and pixels
Google Analytics, the Meta pixel and similar tools use cookies that identify the browser. They should only turn on after consent.
- Online store
Orders, shipping and billing addresses. There's more data here and more responsibility for where it's stored.
- Vendors
The payment gateway, email, CRM or hosting also process that data. Your policy should mention that you share data with third parties to provide the service.
03 Habeas Data
Your customers' rights, and how long you have to respond.
Habeas Data is the constitutional right to know, update and correct the information others hold about you. Law 1581 sets concrete deadlines for it.
Response deadlines under Law 1581
Inquiries = up to 10 business days
Complaints = up to 15 business days
Both deadlines can be extended once in the cases the law provides, notifying the data subject. The authority that oversees compliance is Colombia's Superintendence of Industry and Commerce (SIC).
04 At Blinq
The technical side, ready from day one.
The legal text belongs to your company. We take care of the technical side on every website we build.
What we include
- An unchecked consent box and a link to your policy on every form.
- A cookie notice that doesn't turn on analytics or pixels until the person accepts.
- Forms that ask only for what’s needed to quote or book.
- An AI assistant that gives notice and doesn't ask for sensitive data.
What your lawyer should review
- The text of your data processing policy.
- Whether your company must register its databases with the SIC.
- Contracts with vendors that process data on your behalf.
- Any processing of sensitive data or data about minors.
05 Questions
Frequently asked questions about personal data on your website.
Have another question about how we handle it on your website? Write to us.
Ask on WhatsAppDoes my website need a data processing policy if it only has a form?
Yes. A form that asks for a name, email or phone number already collects personal data, and Law 1581 of 2012 requires you to say what it’s used for and obtain the data subject’s consent. A published policy and a consent box next to the form are the minimum.
Is a cookie notice mandatory in Colombia?
There's no cookie-specific law, but when cookies collect personal data, like analytics or advertising cookies, Law 1581 applies. The prudent approach is to say which cookies you use and ask for consent before turning on the non-essential ones.
What if a customer asks me to delete their data?
It's one of their rights. Your policy should state the channel to do it, and you must respond within the legal deadlines: up to 10 business days for inquiries and up to 15 business days for complaints, extendable in the cases the law provides.
Do an AI assistant or WhatsApp change anything?
Yes: they collect personal data too. The conversation should include a notice linking to your policy, ask only for what's needed and not request sensitive data, like health information, unless it's essential and with express consent.
Does Blinq write my company's data policy?
We build the website with the technical side ready: consent boxes, a link to the policy, a cookie notice with consent and forms that ask only for what's needed. A lawyer should review the legal text of your policy, because it depends on how your company handles data.
Sources
The law, at the source.
This guide summarizes the law; it does not replace it. For your specific case, read the full text and consult a lawyer.
- Law 1581 of 2012
Full text of the law (in Spanish), on the Colombian Senate’s site. The deadlines for requests and complaints are in articles 14 and 15.
- Database registry
National Database Registry (in Spanish), at the SIC: companies with assets above 100,000 UVT and public entities must register.
Google Analytics is a trademark of Google LLC and WhatsApp is a trademark of Meta Platforms, Inc. Blinq is not affiliated with them.
Is your website collecting data without notice?
In the free assessment we review your forms, your chat and your cookies, and tell you what's missing on the technical side.