Ley 1581 de 2012: personal data in health
- Law
Law 1581 of 2012 protects personal data; health data are sensitive and may only be processed with explicit consent or a legal exception.
What it is
Statutory Law 1581 of 2012 (17 October) develops everyone's right to know, update and correct the information held about them in databases (habeas data). Health, sex-life and biometric data are sensitive data: processing them is forbidden except in listed cases. The data protection authority is the Superintendence of Industry and Commerce. Decree 1377 of 2013 regulates the law.
Key articles
- Art. 4: principles: legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality.
- Art. 5: sensitive data are those that affect privacy or may lead to discrimination, including data on health, sex life and biometrics.
- Art. 6: processing sensitive data is forbidden except, among others, with the owner's explicit consent, to protect their vital interest if they are incapacitated, or for historical, statistical or scientific purposes with identities removed.
- Art. 7: processing respects the overriding rights of children and adolescents.
- Art. 8: the owner's rights: to know, update and correct; to ask for proof of consent; to be told how data are used; to complain to the Superintendence; to revoke consent; to access their data free of charge.
- Art. 9: processing requires prior, informed consent that can be checked later.
- Art. 10: no consent is needed in medical or health emergencies, by court order or at the request of a public entity in the exercise of its functions, and for historical, statistical or scientific purposes authorised by law.
- Arts. 19 and 23: the Superintendence of Industry and Commerce oversees and may sanction controllers and processors.
In clinical practice
- Sending patients' photos or results through personal messaging apps or social media is processing sensitive data without consent.
- In an emergency, clinical data can be shared without asking for consent (art. 10, letter c).
- Using records for research needs consent or a scientific purpose authorised by law, and identities are removed.
Status and official text
- Official text checked on 2026-11-05 on funcionpublica.gov.co (Law 1581 of 2012 and Decree 1377 of 2013).
- The Constitutional Court reviewed the bill in Ruling C-748 of 2011: it upheld its form, attached conditions to some articles and struck three articles of the bill for procedural defects.
- Regulated by Decree 1377 of 2013 (compiled in Decree 1074 of 2015); its art. 6 adds that the owner is not obliged to authorise processing of sensitive data and that no activity may depend on handing them over.
- In health it applies together with the confidentiality of the medical record (Law 23 of 1981, art. 34; Resolution 1995 of 1999) and Law 2015 of 2020.
Test yourself
Think of the answer, then tap the question to see it.
What type of data are health data under Law 1581 of 2012?
Sensitive data (art. 5), because they affect privacy and their misuse can discriminate; processing them is forbidden except for the cases in art. 6.
In which health situation is the owner's consent not needed to process their data?
In medical or health emergencies (art. 10, letter c), among other exceptions such as a court order.
Which body is the personal data protection authority in Colombia?
The Superintendence of Industry and Commerce, through a delegated office for personal data protection (art. 19).
Which decree regulates Law 1581 of 2012?
Decree 1377 of 2013, now compiled in Decree 1074 of 2015.
Connections
Educational content on ethics and health law; not legal advice. Laws and case law change: each page links the official text and says when it was last checked. For a real case, read the text in force and ask a lawyer or the medical ethics tribunal.
Sources: Ley Estatutaria 1581 de 2012, por la cual se dictan disposiciones generales para la protección de datos personales (Función Pública, Gestor Normativo, 2012); Decreto 1377 de 2013, por el cual se reglamenta parcialmente la Ley 1581 de 2012 (Función Pública, Gestor Normativo, 2013).
Spotted a mistake?We are always improving for the community. Tell us what is wrong and our team will review it.Report a mistake
Representative model, for educational purposes only.