The processing of financial data, credit records and commercial information, collected in Colombia or abroad, does not require authorization from the Data Subject. However, this information may only be disclosed to:

• The Data Subject or authorized third parties, pursuant to the procedure established by law
• The Users of the Data
• Any judicial or jurisdictional authority upon request
• Any control or administrative authority, when an investigation is ongoing
• Data processors, with the Data Subject’s authorization, or when no authorization is needed , and the database aims for the same objective or involves an activity that may cover the purpose of the disclosing data processor

On the contrary, Law 1581, requires the authorization of the Data Subject for the data controller to process private and semi-private personal data. For the authorization to be valid it must be obtained prior to the data processing and must be "informed", meaning that the data subject must have been made aware of the exact purposes for which the data is being processed. Decree 1377 requires the following:

• Personal data shall only be collected and processed in accordance with the purposes authorized by the Data Subject.
• Such authorization may be obtained by any means, provided that it allows subsequent consultation.   

Authorization is not required when:

• A public or administrative entity demands the information through a judicial order or exercising its legal duties.
• It is public data.
• A medical or sanitary urgency requires the processing of personal data. 
• The data processing is authorized by law for historical, statistical or scientific purposes.
• The data is related to people’s birth certificates.

Regarding sensitive personal data, Section 6 of Decree 1377 states that the data controller shall do the following: 

• Expressly inform the Data Subject that he or she is not compelled to provide sensitive personal data
• Expressly identify what data to be collected and processed is sensitive and
• Obtain the Data Subject's express consent prior to the processing of their sensitive personal data

In any case, silence is not considered a reasonable means of obtaining authorization for personal data or sensitive personal data processing.

Furthermore, when collecting personal data of children, both the data controller and the data processor shall ensure that personal data processed serves and respects the children’s superior interests and guarantees their fundamental rights. For these purposes, the child's legal representative (parent or guardian) must authorize the processing of their child’s personal data.

The SIC has also issued guidelines through External Circular No. 002 of 2024 on the processing of personal data in artificial intelligence (AI) systems. The Circular is applicable to data controllers and processors that develop or use AI based on information containing personal data. The instructions require that data processing in AI be proportional and accountable, implementing risk management and impact assessments for high-risk systems. Data quality in the AI system must be guaranteed and robust security measures applied, suggesting techniques such as differential privacy to protect individuals. Finally, the guidelines emphasize guaranteeing the rights of data subjects through transparency and clarify that even publicly accessible information requires prior, express, and informed consent for its use.