The Superintendency of Industry and Commerce has announced that it will take steps towards a reform of Colombia’s personal data protection regulations, by publishing a draft Circular aimed at adjusting Title V of its Unified Circular aimed at aligning its procedures with recent legislative developments in financial and credit habeas data. The proposal formally incorporates the rules introduced by Laws 2157 of 2021 and 2573 of 2026, updating the mechanisms for protecting personal information and adapting the regulatory framework to the most recent standards established by the Constitutional Court.
Among the most significant changes are new protections for victims of identity fraud in credit reports, mandatory warning notices in such cases, the automatic blocking of negative credit reports where adequate authorization records are unavailable, and the reaffirmation of free access to credit history information. The reform also expands the list of countries deemed to provide an adequate level of data protection, facilitating international data transfers to jurisdictions such as Brazil, Ecuador, Panama, Kenya, and South Africa.
From a business perspective, the initiative also adjusts compliance obligations related to the National Database Registry (RNBD), introducing stricter update schedules and enhanced reporting requirements for both public and private entities. Overall, the reform reflects a broader regulatory trend toward more active oversight of personal data processing, strengthening data subjects’ rights while increasing compliance expectations for organizations handling financial and credit information in Colombia.
