The Superintendence of Industry and Commerce (SIC) issued External Circular No. 003 of 2025, providing instructions on the use of Standard Contractual Clauses for the international transfer and transmission of personal data. These clauses, approved by the Ibero-American Data Protection Network (IDPN), aim to facilitate regulatory compliance and mitigate legal risks associated with cross-border data flows.
The Circular states that standard contractual clauses are an optional mechanism to ensure the protection of personal data when the destination country does not provide an adequate level of protection, in accordance with Article 26 of Law 1581 of 2012. It also clarifies the distinction between international data transfers and data transmissions, as established in Decree 1074 of 2025, and specifies that these clauses operate as an additional safeguard and do not replace existing legal obligations.
Finally, the SIC reminded that data controllers and processors who adopt these clauses must comply with them in full, and that failure to do so may be considered a violation of the authority’s instructions. Through this Circular, the Superintendence reaffirms its role in personal data protection, legal certainty, and the strengthening of the digital economy and international trade in Colombia.
