> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Colombia Habeas Data + CRC Sender Rules

> Configure a tenant-owned Colombia messaging posture around Ley Estatutaria 1581 de 2012 (Habeas Data), Decreto 1377 de 2013, the SIC-operated Registro Nacional de Bases de Datos, CRC telecom rules, and the operator-level sender identities (Claro, Movistar, Tigo) that carry Colombian A2P traffic.

# Colombia Habeas Data + CRC Sender Rules

Colombia's **Ley Estatutaria 1581 de 2012**, regulated by **Decreto 1377 de
2013** — the "Habeas Data" regime — governs every processing of personal
data you perform on Colombian residents: prior, express, and informed
authorization before you contact them; the data subject's rights to know,
update, rectify, and suppress their data; and the **Registro Nacional de
Bases de Datos (RNBD)**, the register of databases the
**Superintendencia de Industria y Comercio (SIC)** operates for
data-processing operations, including the cross-border-transfer posture
your databases rely on. The **Comisión de Regulación de Comunicaciones
(CRC)** governs the telecom half: how A2P SMS and voice traffic enters
Colombian networks and what a sender must show the local operators that
carry it. The regime reaches SMS, voice, and email wherever those
channels process personal data, and for commercial marketing it is an
**opt-in posture**: no authorization, no promotional contact.

The posture is **tenant-owned**. Orbit provides the consent,
suppression, DSAR, and sender-registration surfaces; **the tenant owns
the legal position** — which lawful basis it relies on, whether its
databases are RNBD-reportable, whether its cross-border transfers sit on
an authorized footing, and whether to send at all. Orbit does not
certify a tenant's compliance and does not impose a global Colombia
gate.

<Note>
  This page is documentation, not legal advice. The SIC investigates and
  fines habeas-data violations, and data subjects can file claims
  directly; the CRC and the operators control sender acceptance at the
  network edge. Have counsel confirm whether your traffic is commercial,
  which recipients are covered, whether the RNBD and cross-border
  transfer posture applies to your databases, and which operator
  documents your business must provide. Orbit does not block
  Colombia-bound traffic for missing consent; the regulator and the
  operators enforce their rules regardless of what any toggle says.
</Note>

***

## Colombia obligations mapped to Orbit

Use the live country row and your own legal review together. The table
below maps each statutory duty to the Orbit surface that carries the
evidence.

| Colombia obligation | Tenant-owned posture | Orbit surface and evidence |
| - | - | - |
| Prior, express, and informed authorization before commercial contact | Record the purpose and lawful basis at capture; keep the authorization text version and the source with every record. | [Consent Management](/compliance/consent-management) — `POST /api/v1/compliance/consent` with `purpose` and `lawful_basis`; verify with `GET /api/v1/compliance/consent/lookup` before a campaign. |
| Habeas data rights: know, update, rectify, and cancel | Answer a data-subject inquiry inside the 10-business-day clock and a claim inside 15 business days that Ley 1581 sets; run that SLA on the queue, not in email. | [DSAR Workflow](/compliance/dsar) — intake, SLA clock, and fulfilment trail for every Colombian data-subject request. |
| Suppression of revoked subjects | A revocation wins over any earlier authorization, on every channel; keep the source, timestamp, and scope auditable. | [Opt-Out & Suppression](/compliance/opt-out-suppression) — the suppression ledger your preflight checks read. |
| Revocation of commercial-marketing consent | Publish a Spanish stop instruction on every channel you send; wire replies into suppression at scope `all`. | [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) — the seeded Spanish family (`BAJA`, `CANCELAR`, `SALIR`, `FIN`) plus `RETIRAR` added as a tenant custom alias for Colombia. |
| Sender identity accepted on Colombian networks | Alphanumeric sender IDs are accepted through the local operators (Claro, Movistar, Tigo) on your route; assemble identity and brand evidence before you rely on the sender. | [Sender-ID Registration](/compliance/sender-id-registration) to file and track the sender; [Documents & KYC](/compliance/documents-kyc) for the business evidence an operator requests. |
| RNBD registration and cross-border transfers | Decide with counsel whether your databases are RNBD-reportable and on which footing recipient data leaves Colombia; Orbit stores the platform records, the register filing is yours. | [Data Residency Overview](/compliance/data-residency-overview) and [Data Processing Agreement](/compliance/data-processing-agreement) — where the data lives and the processor contract behind the transfer. |

***

## Sender registration via local operators

Colombia runs its sender acceptance at the operator level rather than
through a single statutory registry: each operator — **Claro**,
**Movistar**, **Tigo** — applies the CRC's sender-identification norms on
its own edge, so an unregistered alphanumeric sender ID filters or
replaces at the operator even when consent is perfect.

1. Use a sender name the recipient can associate with your legal
   business, and keep it consistent across operators.
2. Assemble the company registration, tax identification (NIT), brand
   authorization, and contact details an operator asks for in
   [Documents & KYC](/compliance/documents-kyc).
3. File the sender through
   [Sender-ID Registration](/compliance/sender-id-registration) so the
   application and its approval outcome stay attached to the sender
   record; a sender approved on one operator or one entity is not
   evidence for another.
4. Read the live `CO` row with
   `GET /api/v1/compliance/country-rules?channel=sms&country_code=CO`
   before launch, and re-read it after a CRC or operator change. Do not
   infer registration status from this page's snapshot.

***

## Send-time posture

Every control below is a tenant-owned setting, defaults open. Orbit does
not enforce any of them on your behalf; regulators and operators enforce
their rules regardless.

* **Per-country quiet hours.** Colombia has no statutory SMS no-send
  window, and the common industry convention is to keep promotional
  traffic inside waking hours. Colombia sits at a fixed UTC-5 with no
  daylight saving, so a recipient-local window is stable year round.
  Configure it on
  [Quiet-Hours Configuration](/guides/quiet-hours-configuration); the
  toggle is opt-in, off by default, and fails open when a recipient
  timezone cannot be resolved.
* **Spanish STOP aliases.** The seeded Spanish opt-out family covers
  `BAJA`, `CANCELAR`, `SALIR`, and `FIN`; Colombian campaigns commonly
  advertise `RETIRAR` as well. Add it as a custom alias on the
  [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table)
  before launch — custom additions are additive, and the seeded `STOP`
  and `START` rows can never be removed.
* **Consent-default policy toward opt-in.** Set your organization's
  consent-default policy so marketing traffic requires a recorded
  authorization rather than an assumed one; a suppression entry or a
  data-subject revocation always wins over a consent record. See
  [Consent Default Policy](/compliance/consent-default-policy).
* **Consent-proof URL capture.** Store the opt-in surface event — the
  hosted form submission or keyword receipt — on
  `consent_proof_url` at write time. A consent claim you cannot tie to a
  time, a purpose, and the authorization text the recipient saw does not
  survive a SIC review.

Read the live row before a send:

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms&country_code=CO" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

Confirm `sender_types`, `registration`, `content_restrictions`,
`stop_requirement`, and `last_reviewed_at`. For voice, replace
`channel=sms` with `channel=voice` and use the same `country_code=CO`
filter.

***

## Worked pre-launch configuration

Use this sequence for a Colombia SMS campaign. Each decision is made by
the tenant and remains auditable.

1. **Classify the traffic.** Mark promotional messages as marketing and
   keep transactional notices separate; Ley 1581's authorization
   requirement bites on the commercial side.
2. **Read the live rules.** Fetch the `CO` rows for the channels you
   plan to use and record the sender types, registration level, stop
   requirement, and review timestamp in the launch checklist.
3. **File the sender.** Assemble NIT and brand evidence in
   [Documents & KYC](/compliance/documents-kyc), submit the sender
   through [Sender-ID Registration](/compliance/sender-id-registration),
   and wait for operator approval before first send.
4. **Capture authorization.** For every recipient, write a
   purpose-specific record with `lawful_basis: "consent"` and the
   authorization text version, store the opt-in event on
   `consent_proof_url`, and verify with the consent lookup endpoint.
5. **Configure the stop path.** Confirm the Spanish stop family fires,
   add `RETIRAR` as a custom alias, test the inbound route, and set the
   recipient-local quiet-hours window for `CO`.
6. **Preflight and approve.** Check the suppression ledger for every
   channel, remove every suppressed or revoked recipient, and attach
   the country-row response, sender approval, consent coverage, and
   final message copy to the campaign review — the pre-checks your
   [campaign preflight](/compliance/consent-required-gate) already runs.
   The defensible posture is: an operator-accepted identifiable sender;
   purpose-specific authorization with proof URL for every recipient;
   a working Spanish stop path including `RETIRAR`; a checked
   suppression ledger; and a deliberate quiet-hours window.

***

## Related references

* [Country Compliance Requirements](/compliance/country-requirements) —
  the live per-country, per-channel row behind send-time checks.
* [Sender-ID Registration](/compliance/sender-id-registration) — submit
  and track sender identity applications.
* [Consent Management](/compliance/consent-management) — record and
  verify consent evidence.
* [DSAR Workflow](/compliance/dsar) — the habeas-data rights queue and
  its SLA clock.
* [Mexico NOM-184 Consent](/compliance/mx-nom-184-consent) — sibling LatAm
  opt-in regime.
* [Brazil LGPD + Anatel](/compliance/lgpd-brazil) — sibling LatAm
  data-protection posture.
* [Argentina ENACOM + CCM/AFIP Rules](/compliance/argentina-enacom-rules) —
  sibling LatAm sender and suppression posture.
* [SIC](https://www.sic.gov.co/) ·
  [Ley 1581 de 2012](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=49981) ·
  [Decreto 1377 de 2013](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=53075) ·
  [CRC](https://www.crcom.gov.co/) — official references.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.