Last review date: 10 December 2024

Yes.

The applicable data protection laws expressly prohibit transfers to countries that do not provide an adequate level of data protection. The applicable laws further state that this prohibition does not apply:

• When the data subject has given their prior express and informed consent
• For exchanges of medical data, as required for the treatment of the data subject for health or public hygiene reasons
• For banking or stock exchange operations, in accordance with their applicable laws
• When the transfer is carried out in the context of international treaties that Colombia has ratified, on the basis of the principle of reciprocity
• When the transfer is necessary for the performance of a contract between the data subject and the controller or for the execution of pre-contractual measures as long as the data subject has given their consent
• When the transfer is legally required to safeguard the public interest, or for the establishment, exercise or defense of a right in a judicial proceeding

Transfers of personal data to third countries are only permissible if there is a legal basis for the processing/transfer and one of the following applies:

☒   approved adequate/whitelisted jurisdictions
☒   other solutions

Please see separate question for information on data localization provisions that are not restricted to personal data.

The consent of the data subjects is required.