On July 29, 2025, the Superintendence of Industry and Commerce (SIC), through its Delegation for Personal Data Protection, revoked a fine exceeding 500 million Colombian pesos imposed on a company in the public utilities sector. The ruling concluded that prior authorization was not required to process personal data of a user who submitted a petition related to the service.
The case arose when the company used the contact information voluntarily provided by the user – such as email, address, and phone number – to respond to their complaint. The SIC determined that this data processing was supported by a legal and constitutional mandate: to effectively and timely respond to users’ claims, in compliance with the right of petition and Law 142 of 1994.
The Delegation emphasized that no regulation requires creating additional consent procedures when data processing is solely for responding to a right of petition, as happened in this case.
Finally, the SIC reminded that while not every data processing operation requires prior authorization, companies must limit the use of data to what is strictly necessary and ensure its protection with high security standards.
