Colombia AI Personal Data Rules

Overview

Circular Externa 002 de 2024 establishes supervisory instructions on personal-data processing in artificial intelligence systems for entities supervised by Colombia’s Superintendencia de Industria y Comercio (SIC). Its purpose is to give data administrators greater certainty when developing, deploying, or using AI while protecting individuals whose information supports automated decisions, recommendations, or predictions. The circular addresses the application of existing personal-data protection obligations to AI development, testing, implementation, use, and monitoring.

The instrument was issued on August 21, 2024, and published in Diario Oficial No. 52.856 on August 22, 2024. These dates appear in the MINTIC official legal compilation. Although its title describes lineamientos, or guidelines, the operative introduction states that the SIC instructs supervised entities. It therefore operates as a supervisory regulation implementing existing statutory duties rather than as purely voluntary advice or a separate comprehensive AI statute. Its central premise is technological neutrality: adopting a new procedure, methodology, or technology does not displace the legal protections governing personal information.

Definitions and Scope

The circular draws on CONPES 3975 to describe artificial intelligence as a field of computer science concerned with cognitive problems commonly associated with human intelligence and with intelligent beings capable of adapting to changing situations. It also reproduces the OECD member countries’ 2023 definition of an AI system: a machine-based system that infers from inputs how to generate outputs, including predictions, content, recommendations, or decisions affecting physical or virtual environments. AI systems may differ in their levels of autonomy and their adaptability after deployment.

The circular uses Titulares for individuals whose personal information receives protection and Administradores de Datos personales for actors administering that information. It also refers to Responsables del Tratamiento and Encargados del Tratamiento, corresponding to controllers and processors, in explaining the SIC’s instruction-making powers. Relevant processing includes collection, storage, use, and circulation of personal information. The technology’s role in generating outputs does not remove the responsibilities attached to processing the underlying data.

Responsabilidad demostrada, or demonstrable accountability, concerns the ability to evidence appropriate and effective compliance measures. The circular connects this concept to AI activities across development, testing, monitoring, and implementation. Its focus is the processing operation and the rights of the individual, including when information is used to train an AI system or support its subsequent operation.

Governance and Institutional Framework

The SIC acts through its Delegatura para la Protección de Datos personales. The circular identifies statutory functions that include overseeing compliance with personal-data legislation and issuing instructions on the measures and procedures needed to align controllers’ and processors’ operations with that legislation. It also cites numeral 55 of article 1 of Decree 4886 of 2011, as modified by Decree 092 of 2022, concerning instructions, compliance criteria, and implementation procedures. Supervision of AI-related personal-data processing is consequently situated within the existing data-protection institutional framework.

The circular supports its explanation of supervisory authority with Constitutional Court decisions C-1011 of 2008 and C-748 of 2011. The judicial passages address supervisory instructions, investigation and sanction functions, oversight of international transfers, and promotion of data protection as administrative policing activities. The discussion of C-1011 also addresses the Superintendencia Financiera in connection with the statutory financial-information regime. The circular’s institutional approach connects technological uses of personal information to established legal responsibilities and supervisory powers.

For organizational compliance, the relevant actors are those administering personal information and those carrying out processing under the applicable statutory regime. Identifying these roles provides the basis for determining who must implement safeguards, retain compliance evidence, and respond to the SIC. This organizational allocation supports accountability without changing the circular’s central focus on existing controller, processor, and information-administration responsibilities.

Proportionality and Precaution

Instruction I requires a balancing exercise using four criteria: suitability, necessity, reasonableness, and strict proportionality. Suitability asks whether processing can achieve its proposed objective. Necessity asks whether an equally effective measure would interfere less with personal-data protection. Reasonableness requires processing to pursue constitutionally legitimate purposes. Strict proportionality compares the benefits obtained from restricting data protection with the disadvantages imposed on habeas data, the fundamental right concerning personal information.

These criteria direct attention to the purpose, alternatives, and rights implications of a particular processing operation. A claim that an AI application is innovative or useful does not replace the assessment of whether its processing is suitable and necessary for a legitimate purpose. The balancing exercise links the expected benefit of the activity to its effects on the individual and requires consideration of less intrusive ways to achieve the same objective.

Instruction II addresses uncertainty about potential harm. To avoid serious and irreversible damage, data administrators must refrain from processing or adopt precautionary or preventive measures protecting the data subject’s rights, dignity, and other human rights. This precautionary approach places protection of the individual at the center of decisions made under uncertainty. Instruction III identifies risk identification, classification, and mitigation as essential components of demonstrable accountability, connecting the assessment of potential harm to practical protective measures.

Accountability, Privacy, and Security

The circular describes accountability as adopting useful, timely, efficient, and demonstrable measures capable of establishing full and correct regulatory compliance. It cites article 19A of Law 1266 of 2008 concerning appropriate, effective, and verifiable measures by the relevant information operators, sources, and users. It also cites article 2.2.2.25.6.1 of Decree 1074 of 2015, under which controllers must demonstrate appropriate and effective measures when requested by the SIC. Accountability therefore involves both implementing protective measures and being able to substantiate their effectiveness.

Privacy by design and by default places personal-data protection within the design and launch of AI projects rather than treating it solely as a later corrective exercise. The preamble states that analytics used to train an AI machine should employ mathematical techniques preventing identification of the person providing information. This connects the handling of training data to the protection of individuals and makes privacy relevant to the technical choices used in development.

The circular also addresses technical, human, and administrative security measures intended to prevent alteration, loss, and unauthorized or fraudulent consultation, use, or access. Its privacy and security approach covers both organizational practices and the operation of the system. Documented design reviews, evidence connecting safeguards to processing purposes, and verification that protective measures function in practice are practical ways to support the circular’s demonstrable-accountability approach.

Monitoring and Evaluation

Existing statutory protections apply to collecting or processing personal information to develop, test, and monitor AI systems, as well as during implementation. Compliance therefore extends beyond the launch of a system. Personal information used during testing or monitoring remains subject to the same legal framework, and changes in how a system processes information must be considered in relation to its purposes, safeguards, and effects on individuals.

Risk identification, classification, and mitigation support this lifecycle approach. Demonstrable accountability connects the identification of risks with the adoption of appropriate and effective measures and with evidence of those measures. The SIC’s ability to request compliance evidence gives practical importance to records showing how safeguards relate to actual processing activities. Security controls, privacy protections, and decisions made under the precautionary principle are relevant to that evidentiary record.

Organizations can apply these principles by comparing actual data flows and system uses with the purposes and alternatives assessed for the processing operation. They can retain evidence of security controls and revisit their precautionary analysis when circumstances change or uncertainty about serious harm arises. These practices support continuing compliance with the circular’s principles and the underlying personal-data legislation throughout development and operation.

Supervision and Enforcement

The circular places its instructions within the existing supervisory and enforcement framework for personal-data protection. Its discussion of Constitutional Court decision C-748 of 2011 identifies investigation and sanctioning for noncompliance among the authority’s functions. The cited accountability rule also permits the SIC to request evidence that appropriate and effective compliance measures have been adopted. The instrument thus links operational obligations to the authority’s ability to assess compliance.

The supervisory approach concerns the alignment of controllers’ and processors’ activities with personal-data legislation. Demonstrating compliance requires more than a general assertion that an AI system is secure or beneficial: the measures adopted must be appropriate to the processing and effective in protecting personal information. The circular’s proportionality and precautionary instructions further connect this assessment to the rights, dignity, and other human rights of the affected individuals.

The precautionary instruction is directed toward preventing serious and irreversible harm. Together with risk management, privacy by design and default, and security measures, it supplies a preventive compliance approach within the established statutory system. The circular’s enforcement context is the existing data-protection framework and the SIC’s supervisory powers over the entities subject to its instructions.

Relationship to Other Instruments

Law 1581 of 2012 supplies the general personal-data protection framework and the circular’s principal rights-based foundation. Law 1266 of 2008 is also expressly relevant, particularly to the information regime discussed in the accountability and supervisory passages. The circular treats both statutes as thematically and technologically neutral, extending their protections to processing performed through AI. Decree 1074 of 2015 provides the cited demonstrable-accountability rule for controllers, while Decree 4886 of 2011, modified by Decree 092 of 2022, supports the SIC’s instruction-making competence.

CONPES 3975 supplies an AI definition. Constitutional Court decision T-323 of 2024 is quoted for the proposition that AI systems must comply with the technologically neutral personal-data statutes. Decisions C-1011 of 2008 and C-748 of 2011 support the institutional explanation of supervision and instruction-making powers. These instruments form the legal and policy context for applying existing protections to AI; the circular implements that framework rather than replacing it.

The Bogotá government legal database reproduction of Circular Externa 002 de 2024 and the MINTIC compilation of the circular provide official government access to the instrument and its discussion of these supporting authorities.

International Alignment

The circular’s use of the OECD member countries’ 2023 AI-system definition connects its descriptive terminology to an international, machine-based and inference-focused understanding of AI. That definition covers predictions, content, recommendations, and decisions and recognizes differences in autonomy and post-deployment adaptability. The circular also uses the English expressions accountability and Privacy by Design and by Default to explain its domestic compliance approach.

The constitutional discussion refers to international standards for supervisory authorities and includes oversight of international data transfers among the SIC’s functions. These connections place the instrument within broader data-protection concepts while maintaining its basis in Colombian personal-data legislation. For organizations operating internationally, the relevant obligation is to apply the Colombian framework to processing subject to that framework, including AI activities involving personal information.

Shared international terminology and domestic legal duties serve different functions. The OECD definition describes the systems under discussion, while Colombia’s statutes, implementing decrees, and SIC instructions establish the applicable personal-data responsibilities. The circular’s focus on individual rights, accountability, proportionality, and preventive safeguards expresses that distinction in its approach to AI processing.

Implementation Timeline

Compliance Checklist

Sources and References