The framework
Colombia's framework rests on Law 1581 of 2012 (habeas data), with the Superintendence of Industry and Commerce as the supervisory authority.
That puts Colombia in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law 1581 of 2012 (habeas data)
Colombia pairs a strict express-consent standard with one of Latin America's most active enforcers: the SIC issues a constant stream of fines, including for unsolicited marketing, and runs the mandatory database registry.
Marketing and advertising
Prior, express and informed consent is the general rule, with a national database registry (RNBD) for larger companies. That single sentence decides most channel plans here.
Cross-border transfers
Adequate-protection standard per SIC circulars; declarations of conformity available.
Enforcement and penalties
Fines up to about 2,000 monthly minimum wages per violation; the SIC fines frequently.