Data and identity regulations in Colombia

1 regulationLast reviewed:

The Colombian rules that shape how you verify customers' identity, handle identity theft cases and process personal data in digital onboarding.

If you onboard users in Colombia, these are the rules that shape how you verify their identity, handle identity theft cases and process their personal data. We start with Law 2573 of 2026, which takes effect in November, and will add more regulations in the coming weeks.

Quick overview

RegulationWhat it coversStatus
Law 2573 of 2026Identity verification and protection from negative credit reports and debt collection caused by identity theft, for telcos, financial institutions and businesses that sell on credit.Takes effect Nov 19, 2026

The general framework is Law 1581 of 2012 (the general personal data protection regime, overseen by the Superintendence of Industry and Commerce) and Law 1266 of 2008 (financial habeas data). Law 2573 refers to the principles of both.

Identity in Colombia: the basics

Colombian citizens are identified by their cédula de ciudadanía, issued by the National Civil Registry (Registraduría Nacional del Estado Civil). Foreign nationals use, among others, the cédula de extranjería or the Temporary Protection Permit (PPT) issued by Migración Colombia. An onboarding flow should check three things:

  • the number exists and belongs to the person;
  • the document is valid;
  • the person in front of the camera is its holder.

Under Law 2573 you also need to keep evidence of those checks so you can answer an identity theft complaint within 10 business days.

Regulations in this country

Other regulations

See all regulations and filter by country or topic →

Need identity verification and consent that hold up to an audit?

Book a meetingExplore smartCHECKAPI docs

Talk to a compliance specialist

Tell us about your onboarding flow and we will map the identity checks, biometrics and consent records you need.

Sources

  1. Statutory Law 2573 of 2026 (official text, MinTIC, in Spanish)
  2. SIC: Law 2573 of 2026 (in Spanish)
  3. SIC: public consultation on identity validation and protocol schedule (in Spanish)
  4. Law 1581 of 2012 on personal data protection (in Spanish)
  5. Law 1266 of 2008, financial habeas data (in Spanish)

Disclaimer: This content is for information only and is not legal advice. It summarizes the official text as of the last-reviewed date; always check the official source and your legal counsel before making compliance decisions.