Data and identity regulations in Colombia
The Colombian rules that shape how you verify customers' identity, handle identity theft cases and process personal data in digital onboarding.
If you onboard users in Colombia, these are the rules that shape how you verify their identity, handle identity theft cases and process their personal data. We start with Law 2573 of 2026, which takes effect in November, and will add more regulations in the coming weeks.
Quick overview
| Regulation | What it covers | Status |
|---|---|---|
| Law 2573 of 2026 | Identity verification and protection from negative credit reports and debt collection caused by identity theft, for telcos, financial institutions and businesses that sell on credit. | Takes effect Nov 19, 2026 |
The general framework is Law 1581 of 2012 (the general personal data protection regime, overseen by the Superintendence of Industry and Commerce) and Law 1266 of 2008 (financial habeas data). Law 2573 refers to the principles of both.
Identity in Colombia: the basics
Colombian citizens are identified by their cédula de ciudadanía, issued by the National Civil Registry (Registraduría Nacional del Estado Civil). Foreign nationals use, among others, the cédula de extranjería or the Temporary Protection Permit (PPT) issued by Migración Colombia. An onboarding flow should check three things:
- the number exists and belongs to the person;
- the document is valid;
- the person in front of the camera is its holder.
Under Law 2573 you also need to keep evidence of those checks so you can answer an identity theft complaint within 10 business days.
Regulations in this country
Other regulations
Need identity verification and consent that hold up to an audit?
Talk to a compliance specialist
Tell us about your onboarding flow and we will map the identity checks, biometrics and consent records you need.
Sources
Disclaimer: This content is for information only and is not legal advice. It summarizes the official text as of the last-reviewed date; always check the official source and your legal counsel before making compliance decisions.