Guides
Data protection for nutritionists in Colombia: Law 1581
What Law 1581 of 2012 requires from a nutrition practice in Colombia: prior authorisation for sensitive data, the information treatment policy, the RNBD, and who actually has to register.
The Colombian regime rests on a simple idea: processing sensitive data requires prior, express, informed authorisation. Health data always qualifies. This guide turns that into what you need signed, written, and documented in practice.
The framework is Law 1581 of 2012, implemented by Decree 1074 of 2015 — which consolidates the former Decree 1377 of 2013. The authority is the Superintendency of Industry and Commerce (SIC), through its Delegate Office for Personal Data Protection.
Sensitive data and prior authorisation
Article 5 of Law 1581 defines as sensitive any data affecting the data subject’s privacy or whose misuse could generate discrimination, and expressly includes health data. Processing it requires prior, express, informed authorisation, plus two additional duties that are frequently forgotten:
- Telling the person that sensitive data is involved and which data it is.
- Telling them explicitly that they are not obliged to authorise its processing.
The information treatment policy
This is a mandatory document, distinct from the privacy notice, and it must be available to the data subject. At minimum it must set out:
- Identification, physical or electronic address, and phone number of the controller.
- The processing the data will undergo and its purpose.
- The rights available to the data subject.
- The area or person responsible for handling queries and complaints.
- The procedure for exercising rights.
- The effective date and the validity period of the database.
Do you have to register with the RNBD?
Probably not, and it is worth knowing because a lot of outdated information circulates. The National Database Registry started with a broad scope, but Decree 090 of 2018 narrowed who is obliged.
| Who you are | Must you register with the RNBD? |
|---|---|
| Independent professional (natural person) | No — Decree 090 of 2018 exempts natural persons |
| Company with total assets under 100,000 UVT | No |
| Company with total assets over 100,000 UVT | Yes |
| Non-profit entity above that same threshold | Yes |
| Public-law entity | Yes |
Queries and complaints
The law sets concrete deadlines for responding, and they are short. Having a declared channel and a written procedure is not bureaucracy: it is what lets you answer in time without improvising.
| Request | Response deadline | Extension |
|---|---|---|
| Query | 10 business days | Up to 5 more business days, stating the reason |
| Complaint | 15 business days | Up to 8 more business days, stating the reason |
How it meets the clinical record
Resolución 1995 de 1999 requires keeping the clinical record for at least twenty years from the last episode of care, split between a working archive and a central archive. Data protection law, for its part, requires deleting what no longer has a purpose. They reconcile as elsewhere in the region: retention is a legitimate purpose, but active use of the data ends when the care relationship does.
Safeguards
- A named account and individual password for each person with access, with a second factor where possible.
- Encryption on the machines and devices used to view records.
- Backups with restoration actually tested.
- Confidentiality agreements with all staff and collaborators.
- Access logging where the tool supports it.
- Locked physical storage for anything still on paper.
Processors
Your practice software, payment gateway, email, and cloud storage are processors: they handle data on your behalf. Responsibility towards the client stays with you, so ask each vendor for the corresponding agreement and confirm where data is hosted before signing up.
Frequently asked questions
Can authorisation be verbal?
The law allows different forms as long as the authorisation can be evidenced. For sensitive data, written or electronic form with a record is always preferable, because the burden of proving it falls on you.
Do I need authorisation to send appointment reminders?
Reminders tied to delivering the service fall within the purpose already authorised. Sending promotions or marketing content is a different purpose and needs its own authorisation.
What if the client withdraws authorisation?
You must stop processing for the withdrawn purposes, but the clinical record is retained under the legal obligation in Resolución 1995. Explain that in writing and document the decision.
Does it apply if I work by telemedicine from another country?
If you process data of people in Colombia, the Colombian regime may reach you alongside that of the country where you are established. The prudent path is aligning to the stricter of the two.
This guide is informational and is not legal advice. Check the regulations in force in your country and consult a professional if in doubt.
Next step
Take clinical nutrition to the next level with Almendra
Design plans, manage clients, and automate follow-ups in a single platform.