Cybersecurity law & regulation in Colombia (2026)

Legal framework

CONPES 3995 (2020), National Digital Trust and Security Policy; Decree 338 of 2022, Digital Security Governance and Critical Infrastructure; Law 1581 of 2012, Personal Data Protection with breach notification; MinTIC / ColCERT as primary governance bodies; National Digital Security Strategy 2025-2027

Key points: cybersecurity in Colombia

1. 01CONPES 3995, National Policy

   Adopted 1 July 2020, CONPES 3995 sets Colombia's overarching digital-trust and security policy, mandating strengthened capabilities across citizens, the public sector and the private sector, and updating the digital-security governance framework. Implementation is coordinated by MinTIC, the Ministry of National Defence and the National Planning Department.

   colaboracion.dnp.gov.co dnp.gov.co

2. 02Decree 338 of 2022, Critical Infrastructure & Incident Reporting

   Decree 338 (8 March 2022) amended Decree 1078/2015 to require public entities and private operators of critical cyber infrastructure or essential services to register with MinTIC through ColCERT, conduct regular risk assessments, and report incidents via the National Platform for Notification and Monitoring of Digital Security Incidents operated by ColCERT.

   funcionpublica.gov.co gobiernodigital.mintic.gov.co

3. 03Data-Breach Notification (SIC / Law 1581)

   Under Law 1581 of 2012 and SIC guidelines, data controllers and processors must notify the SIC of any security breach affecting personal data within 15 working days of detection. There is no harm threshold for triggering notification, and the SIC recommends (but does not legally mandate) concurrent notice to affected individuals.

   dlapiperdataprotection.com resourcehub.bakermckenzie.com

4. 04National Digital Security Strategy 2025-2027

   Launched by MinTIC in June 2025 with OAS/CICTE support, the Strategy sets 29 cross-cutting actions to consolidate a resilient digital environment following nearly 36 billion attack attempts against Colombia in 2024 (second most-attacked country in Latin America). It targets the financial, health and energy sectors as priority areas and reports a 48% reduction in cyber incidents during 2025.

   mintic.gov.co mintic.gov.co

5. 05Proposed Cybersecurity Law & National Agency

   Draft bills filed in Congress in 2023 (PL 010-23 Senate; PL 023-2023C House) seek to create a National Digital Security and Space Affairs Agency and enact a standalone cybersecurity statute. As of mid-2026, neither bill has been enacted; the government has indicated intent to re-file legislation in a subsequent congressional period.

   leyes.senado.gov.co camara.gov.co

6. 06ColCERT, National CSIRT

   The Grupo de Respuesta a Emergencias Cibernéticas de Colombia (ColCERT), under MinTIC, is the national coordination body for cyber incident response. It advises public and private entities, coordinates sectoral CSIRTs, and maintains the national incident notification platform established by Decree 338/2022.

   colcert.gov.co lloredacamacho.com

Timeline of decisions

1. 1 Jan 2025Guidance · official
   National Digital Security Strategy 2025-2027 Launched

   MinTIC published the Estrategia Nacional de Seguridad Digital 2025-2027, responding to Colombia's position as Latin America's second-most-attacked country (36 billion attempted intrusions in 2024, ~17 % of regional total). The strategy establishes a National Security Operations Centre, reinforces the ColCERT coordination model, and sets sector-specific resilience targets for finance, health, and energy.

   MinTIC

2. 24 Jun 2024Guidance · official
   MinTIC Resolution 2239 Updates Government Information-Security Policy

   Resolution 2239 replaced Resolution 448 of 2022 and updated the General Policy on Information Security, Privacy, Digital Security, and Operational Continuity for all MinTIC systems. It aligned Colombia's public-sector security baseline with ISO/IEC 27001:2022 and embedded the refreshed Information Security and Privacy Model (MSPI).

   MinTIC

3. 12 Sept 2023Incident
   IFX Networks Ransomware Supply-Chain Attack Paralyses Colombian Government

   A ransomware attack on cloud-hosting provider IFX Networks disrupted more than 762 client organisations across Latin America, including Colombia's Ministries of Justice, Health, and Culture; approximately 2 million judicial proceedings were paralysed and a Ministry of Health database with 50 million records was encrypted. The presidential technology adviser called it the largest cyber-attack on Colombian infrastructure in recent years, and the government announced legal action against the provider.

   Recorded Future News / The Record

4. 1 Jan 2023Law · official
   MinTIC Files Draft Bill to Create National Digital Security Agency

   MinTIC introduced a draft law before Congress to create a specialised Agencia Nacional de Seguridad Digital y Asuntos Especiales, which would centralise national-level cybersecurity planning, risk coordination, and incident response, filling the institutional gap exposed by the IFX Networks and Keralty attacks.

   MinTIC

5. 8 Mar 2022Law · official
   Decree 338 of 2022 Creates National Digital Security Governance Model

   Decree 338 added a new title to the Regulatory Decree 1078 of 2015, establishing the national Digital Security Governance Model, formalising ColCERT's coordinating role, requiring public entities to identify critical cyber infrastructure and essential services, and mandating structured incident response via five governance bodies including a Unified Digital Security Command. This is the principal instrument governing public-sector cybersecurity obligations today.

   Función Pública (Official Gazette)

6. 1 Jul 2020Guidance · official
   CONPES 3995: National Policy on Digital Trust and Security

   The National Council for Economic and Social Policy approved Colombia's first comprehensive national cybersecurity strategy, setting out a 2020–2022 action plan to strengthen digital security capabilities of citizens, government, and the private sector, update the governance framework for cyber incidents, and adapt to Fourth Industrial Revolution technologies.

   Departamento Nacional de Planeación (DNP)

7. 24 Jul 2018Law · official
   Ley 1928 of 2018: Ratification of the Budapest Convention on Cybercrime

   Colombia formally approved the Council of Europe's Budapest Convention on Cybercrime, the principal international treaty on computer crime. Ratification aligned Colombia's legal framework with international standards on cybercrime definitions and enabled binding cross-border law enforcement cooperation for online offences.

   Secretaría del Senado de Colombia

8. 11 Apr 2016Guidance · official
   CONPES 3854: Second-Generation National Digital Security Policy

   CONPES 3854 superseded CONPES 3701 and reframed cybersecurity as a socio-economic risk-management challenge rather than purely a defence and criminal-justice matter. It introduced a multi-stakeholder governance structure, embedded risk management in government operations, and aligned Colombia with international frameworks including the NIST Cybersecurity Framework.

   DNP / CONPES

9. 1 Jan 2012Decision
   ColCERT and Cyber Police Command (CCP) Established

   Acting on CONPES 3701 mandates, Colombia stood up ColCERT (Grupo de Respuesta a Emergencias Cibernéticas de Colombia) under the Ministry of Defence/Armed Forces and the Centro Cibernético Policial under the National Police. These two institutions became the operational backbone of national incident response and cybercrime investigation.

   Diálogo Américas

10. 14 Jul 2011Guidance · official
    CONPES 3701: Colombia's Founding National Cybersecurity and Cyberdefense Policy

    CONPES 3701 was Colombia's first comprehensive national cybersecurity strategy, defining the concepts of ciberseguridad and ciberdefensa and directing the creation of specialist institutions (ColCERT, CCP) and a regulatory framework. It established the doctrinal and institutional architecture that all subsequent cybersecurity policy has built upon.

    DNP / CONPES

11. 5 Jan 2009Law · official
    Ley 1273 of 2009: Computer Crimes and Protection of Information Act

    Colombia's first dedicated cybercrime statute amended the Penal Code to criminalise unauthorized computer access, malware deployment, phishing, computer fraud, interception of data, and unlawful personal data capture. Sentences reach up to 120 months' imprisonment, making this the backbone of criminal enforcement for online offences in Colombia.

    Secretaría del Senado de Colombia

Sources

1. 1.colaboracion.dnp.gov.co/cdt/Conpes/Econ%C3%B3micos/3995.pdf
2. 2.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=181866
3. 3.gobiernodigital.mintic.gov.co/692/articles-238198_recurso_1.pdf
4. 4.dlapiperdataprotection.com/index.html?t=breach-notification&c=CO
5. 5.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/latin-america/colombia/to
6. 6.mintic.gov.co/portal/inicio/Sala-de-prensa/Noticias/403023:La-Estrategia-Nacional-d
7. 7.mintic.gov.co/portal/715/articles-403023_recurso_2.pdf
8. 8.colcert.gov.co/800/w3-article-198657.html
9. 9.leyes.senado.gov.co/proyectos/images/documentos/Textos%20Radicados/proyectos%20de%20ley/2
10. 10.dnp.gov.co/LaEntidad_/subdireccion-general-prospectiva-desarrollo-nacional/direc
11. 11.camara.gov.co/wp-content/uploads/2025/10/proyectos-ley/documentos/proyecto-33275/pl
12. 12.lloredacamacho.com/en/general-guidelines-to-strengthen-the-governance-of-digital-securit