Per Law 1581, the transfer of personal data occurs if the data controller or the data processor located in Colombia transmits the personal data to a recipient, in or outside of Colombia, who is responsible for the personal data, i.e., a data controller.

Cross-border data transfers are prohibited unless the country to which the data will be transferred to provides at least equivalent data privacy and protection standards and adequate safeguards to those provided by Colombian law. In this regard, adequate levels of data protection will be determined in accordance with the standards set by the SIC. 

This restriction does not apply to the following cases: 

• If the Data Subject expressly consented to the cross-border transfer of data
• Exchange of medical data
• Bank or stock transfers
• Transfers agreed to under international treaties to which the Colombia is a party
• Transfers necessary for the performance of a contract between the Data Subject and the controller, or for the implementation of pre-contractual measures, provided the data owner consented, and
• Transfers legally required in order to safeguard the public interest

Therefore, the Data Subject authorization for transferring the personal data abroad is required, unless such transfer is to an authorized country, which, according to the SIC, meets the standard of data protection and security levels. 

Further, personal data can be transferred to any country, which the European Commission considers to meets its standard for levels of protection.

Transmission of personal data 

The transmission of personal data takes place when the data controller provides personal data to a data processor, in Colombia or abroad, in order to allow the data processor to process the personal data on behalf of the data controller. The data subject’s consent is required for the transmission of data, unless an adequate data transfer agreement between the data processor and the data controller is in place. 
In this regard, Decree 1377 requires that the aforementioned agreement include the following clauses:

• The extent and limitations of the data treatment
• The activities that the data processor will perform on behalf of the data controller, and
• The obligations the data processor has to data subjects and the data controller 
  The data processor has three additional obligations when processing personal data: 
  
  • Process data according to the legal principles established in Colombian law
  • Guarantee the safety and security of the databases
  • Maintain strict confidentiality of the personal data  

A data controller transmitting data to a data processor must identify the data processor in the National Database Register for each database transferred. Finally, the data processor must process the personal data in accordance with the data controller’s privacy policy and the data subject's authorization.

The SIC recently issued External Circular No. 003 of 2025, which provides instructions on standard contractual clauses for the transfer and transmission of personal data. This Circular instructs data controllers and data processors located in Colombia on the transfers and transmissions of personal data, indicating that the model contractual clauses included in the “Guide for Implementation of Model Contractual Clauses for the International Transfer of Personal Data” approved by the Iberoamerican Network for the Protection of Data are an optimal resource to guarantee that the international transfer and transmission of personal data are under security standards and respect to the rights of data subjects. The model contractual clauses may be used whenever the recipient country is not included in the list of countries with an adequate level of data protection.