Colombia's Law 1581 on data protection: what your business must comply with on WhatsApp and CRM
If you store customers in a CRM or message them on WhatsApp in Colombia, Law 1581 of 2012 applies to you. What it requires, what rights people have and what you risk.
A customer writes to you, upset: “Where did you get my number? I never gave you permission to send me promotions”. You check your CRM and have no way to prove otherwise. The number came from a database someone on the team put together two years ago.
That conversation, which looks like a simple complaint, can end in Colombia as a formal complaint before the Superintendence of Industry and Commerce. If your business stores customer data in a CRM or messages customers on WhatsApp, Law 1581 of 2012 applies to you. This is what you need to know, in business language.
What is Law 1581 of 2012?
It is Colombia's personal data protection law, known as the habeas data law: it regulates how businesses collect, store, use and share people's information. According to its official text, data processing is governed by eight principles: legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality.
In plain terms: you can only use the data for what you said, with permission, securely and without passing it on to just anyone.
Do I need consent to message my customers?
Yes: the law requires the prior and informed authorization of the data subject, except for the exceptions the law itself provides. Prior means before using the data; informed means the person knows what you will use it for.
In practice, for a business that sells on WhatsApp:
| Moment | What to do |
|---|---|
| The customer fills out a form or writes for the first time | State the purpose and ask for consent |
| You save the contact in the CRM | Record when and how they consented |
| You send promotions | Send only to those who consented to that use |
| The customer asks you to stop writing | Revoke and stop sending |
Common mistake: buying or “inheriting” databases and sending them WhatsApp campaigns. Besides the legal risk, Meta penalizes numbers that receive many blocks and reports, and your sending quality drops. We explain it in WhatsApp templates.
What rights do my customers have over their data?
Article 8 gives them six specific rights, and your sales process must be able to handle them:
- Access, update and correct their personal data.
- Request proof of the authorization they gave.
- Be informed about how their data has been used.
- File complaints with the Superintendence of Industry and Commerce.
- Revoke the authorization and request the deletion of their data.
- Access their personal data free of charge.
This is where a well-configured CRM helps: if each contact has its source and authorization recorded, answering a request takes minutes. If your data lives in scattered chats and spreadsheets, it is almost impossible. If you do not have one yet, start with what a CRM is and when your business needs one.
How much can breaking the law cost me?
Up to 2,000 current legal monthly minimum wages in fines, according to Article 23, in addition to the possible suspension or closure of data processing operations. The authority in charge is the Superintendence of Industry and Commerce, which also manages the National Database Registry, defined by the law as the public directory of databases subject to processing in the country.
Watch out: this article is a practical guide, not legal advice. For your data processing policy and your database registration, rely on a specialized lawyer.
How do I get my WhatsApp and CRM compliant?
- Publish your data processing policy on your website and link to it wherever you ask for data.
- Ask for consent at first contact: in the form, in the welcome message of the bot or the AI agent.
- Record the consent in the CRM: date, channel and purpose.
- Separate lists: those who agreed to promotions and those who only want follow-up on their purchase.
- Create an easy way out: a word like “STOP” that the system understands and applies on its own.
If you serve customers in Colombia and also in the United States, remember that each country has its own regulation; the foundation is still the same: clear permission, honest use and protected data.
In short
Law 1581 is not paperwork you file away: it is how you sell on WhatsApp without a complaint catching you off guard. Prior consent, rights handled and data organized in your CRM. That way, when a customer asks “where did you get my number?”, you will have the answer in one click. We help you set it up in our WhatsApp Business API service.
Frequently asked questions
Does Law 1581 apply to my WhatsApp contact list?
If your business collects and uses customers' personal data in Colombia (name, phone, email), that data is subject to Law 1581, regardless of whether it lives in a CRM, in Excel or on WhatsApp.
What kind of consent do I need?
The law requires prior and informed authorization from the data subject. In practice, it is worth keeping proof of that authorization, because the data subject has the right to request it.
What happens if a customer asks me to delete their data?
The data subject can revoke the authorization and request the deletion of their data. Your process must allow you to handle that request and stop writing to them.
What is the fine for not complying with Law 1581?
Article 23 allows the Superintendence to impose fines of up to 2,000 current legal monthly minimum wages, in addition to suspending or closing data processing operations.
Do not stop at the theory: apply it to your business
We implement the WhatsApp Business API end to end, with your real operation. The first conversation is free.
