Skip to main content

​
Colombia Habeas Data + CRC Sender Rules

Colombia’s Ley Estatutaria 1581 de 2012, regulated by Decreto 1377 de 2013 — the “Habeas Data” regime — governs every processing of personal data you perform on Colombian residents: prior, express, and informed authorization before you contact them; the data subject’s rights to know, update, rectify, and suppress their data; and the Registro Nacional de Bases de Datos (RNBD), the register of databases the Superintendencia de Industria y Comercio (SIC) operates for data-processing operations, including the cross-border-transfer posture your databases rely on. The Comisión de Regulación de Comunicaciones (CRC) governs the telecom half: how A2P SMS and voice traffic enters Colombian networks and what a sender must show the local operators that carry it. The regime reaches SMS, voice, and email wherever those channels process personal data, and for commercial marketing it is an opt-in posture: no authorization, no promotional contact. The posture is tenant-owned. Orbit provides the consent, suppression, DSAR, and sender-registration surfaces; the tenant owns the legal position — which lawful basis it relies on, whether its databases are RNBD-reportable, whether its cross-border transfers sit on an authorized footing, and whether to send at all. Orbit does not certify a tenant’s compliance and does not impose a global Colombia gate.
This page is documentation, not legal advice. The SIC investigates and fines habeas-data violations, and data subjects can file claims directly; the CRC and the operators control sender acceptance at the network edge. Have counsel confirm whether your traffic is commercial, which recipients are covered, whether the RNBD and cross-border transfer posture applies to your databases, and which operator documents your business must provide. Orbit does not block Colombia-bound traffic for missing consent; the regulator and the operators enforce their rules regardless of what any toggle says.

​
Colombia obligations mapped to Orbit

Use the live country row and your own legal review together. The table below maps each statutory duty to the Orbit surface that carries the evidence.

​
Sender registration via local operators

Colombia runs its sender acceptance at the operator level rather than through a single statutory registry: each operator — Claro, Movistar, Tigo — applies the CRC’s sender-identification norms on its own edge, so an unregistered alphanumeric sender ID filters or replaces at the operator even when consent is perfect.
  1. Use a sender name the recipient can associate with your legal business, and keep it consistent across operators.
  2. Assemble the company registration, tax identification (NIT), brand authorization, and contact details an operator asks for in Documents & KYC.
  3. File the sender through Sender-ID Registration so the application and its approval outcome stay attached to the sender record; a sender approved on one operator or one entity is not evidence for another.
  4. Read the live CO row with GET /api/v1/compliance/country-rules?channel=sms&country_code=CO before launch, and re-read it after a CRC or operator change. Do not infer registration status from this page’s snapshot.

​
Send-time posture

Every control below is a tenant-owned setting, defaults open. Orbit does not enforce any of them on your behalf; regulators and operators enforce their rules regardless.
  • Per-country quiet hours. Colombia has no statutory SMS no-send window, and the common industry convention is to keep promotional traffic inside waking hours. Colombia sits at a fixed UTC-5 with no daylight saving, so a recipient-local window is stable year round. Configure it on Quiet-Hours Configuration; the toggle is opt-in, off by default, and fails open when a recipient timezone cannot be resolved.
  • Spanish STOP aliases. The seeded Spanish opt-out family covers BAJA, CANCELAR, SALIR, and FIN; Colombian campaigns commonly advertise RETIRAR as well. Add it as a custom alias on the Opt-Out Keyword Alias Table before launch — custom additions are additive, and the seeded STOP and START rows can never be removed.
  • Consent-default policy toward opt-in. Set your organization’s consent-default policy so marketing traffic requires a recorded authorization rather than an assumed one; a suppression entry or a data-subject revocation always wins over a consent record. See Consent Default Policy.
  • Consent-proof URL capture. Store the opt-in surface event — the hosted form submission or keyword receipt — on consent_proof_url at write time. A consent claim you cannot tie to a time, a purpose, and the authorization text the recipient saw does not survive a SIC review.
Read the live row before a send:
Confirm sender_types, registration, content_restrictions, stop_requirement, and last_reviewed_at. For voice, replace channel=sms with channel=voice and use the same country_code=CO filter.

​
Worked pre-launch configuration

Use this sequence for a Colombia SMS campaign. Each decision is made by the tenant and remains auditable.
  1. Classify the traffic. Mark promotional messages as marketing and keep transactional notices separate; Ley 1581’s authorization requirement bites on the commercial side.
  2. Read the live rules. Fetch the CO rows for the channels you plan to use and record the sender types, registration level, stop requirement, and review timestamp in the launch checklist.
  3. File the sender. Assemble NIT and brand evidence in Documents & KYC, submit the sender through Sender-ID Registration, and wait for operator approval before first send.
  4. Capture authorization. For every recipient, write a purpose-specific record with lawful_basis: "consent" and the authorization text version, store the opt-in event on consent_proof_url, and verify with the consent lookup endpoint.
  5. Configure the stop path. Confirm the Spanish stop family fires, add RETIRAR as a custom alias, test the inbound route, and set the recipient-local quiet-hours window for CO.
  6. Preflight and approve. Check the suppression ledger for every channel, remove every suppressed or revoked recipient, and attach the country-row response, sender approval, consent coverage, and final message copy to the campaign review — the pre-checks your campaign preflight already runs. The defensible posture is: an operator-accepted identifiable sender; purpose-specific authorization with proof URL for every recipient; a working Spanish stop path including RETIRAR; a checked suppression ledger; and a deliberate quiet-hours window.