ListoApp

Guide · Compliance

AI and Data Privacy: What Colombia's Law 1581 Requires If You Use Customer Data

If your AI assistant reads customer conversations, you're processing personal data. Here's the bare minimum Colombian law requires — in plain language. This isn't legal advice, it's the checklist we work from ourselves.

Written by the ListoApp team · August 2026 · 6 min read

This topic scares a lot of people and it shouldn't. Law 1581 of 2012 doesn't ban using AI with customer data: it requires you to do it in an informed, traceable way. The list is short.

1. Are you processing personal data?

If you can identify a person from what you have — name, phone number, email, ID number, order history tied to someone — then yes. And a WhatsApp conversation is, by definition, personal data: the phone number identifies its owner.

2. Prior, express, and informed consent

Three words that matter:

• Prior: before you process the data, not after.
• Express: an action taken by the data subject, not assumed silence.
• Informed: the data subject knows what you're going to use it for.

You must be able to prove that consent. Keeping a record of when and how it was granted is part of the obligation.

3. Data processing policy

A public document, on your website, that states at minimum: who is responsible for the data and how to contact them, what data you collect, for what purpose, what rights the data subject has, and the procedure to exercise them. Our own policy is here if you want to see it as a structural reference.

4. ARCO rights, with a channel that actually works

Access, rectification, cancellation, and objection. Mentioning them isn't enough: there has to be an email or form that someone actually monitors, with response times:

• Inquiries: up to 10 business days.
• Complaints: up to 15 business days.

The data subject can also file a complaint with Colombia's Superintendency of Industry and Commerce (SIC).

5. The AI-specific part

This is where most people get it wrong. Three questions you should be able to answer:

1. Where does the data travel to? If you use a third-party model, the data leaves your infrastructure. That has to be disclosed in your policy.
2. Is it used for training? Check the provider's terms. Some enterprise plans exclude your data from training; free tiers often don't.
3. Are you sending more than necessary? The purpose-limitation principle requires sending only what's essential. There's no reason to send a customer's ID number to a model that only needs to answer about a delivery window.

Our rule on the projects we build: the business's knowledge lives on the client's own infrastructure and is never used to train third-party models. When the contract ends, it's handed over or deleted per their instructions.

6. Responsible AI: CONPES 3975

This is Colombia's national policy on digital transformation and artificial intelligence. It isn't an enforceable statute like Law 1581, but it sets out principles — transparency, fairness, non-discrimination — and carries weight when public procurement is involved. Worth aligning with.

Checklist

• Data processing policy published and accessible from the footer.
• Initial message that discloses the purpose and links to the policy.
• Record of consent granted.
• Active inbox for ARCO rights requests, with a responsible owner assigned.
• Contract or terms with your AI vendor reviewed for training use and confidentiality.
• Minimization: only what's necessary is sent to the model.

This doesn't replace a lawyer's opinion, and if you process sensitive data or data belonging to minors, get one. But this checklist covers what most small businesses are missing.

Frequently asked questions

Does Law 1581 apply if I use AI with customer data?

Yes. The law regulates the processing of personal data regardless of the technology used. If the assistant reads, stores, or processes data belonging to an identifiable person, it applies.

Do I need consent if the customer messages me first on WhatsApp?

You need to disclose the purpose and obtain consent for any use beyond answering that specific query. An initial message with a link to your privacy policy and the stated purpose of processing is the minimum practice.

Can I use ChatGPT or third-party models with my customers' data?

You can, but you need to review the provider's terms on using data for training, disclose it in your privacy policy, and avoid sending sensitive data that isn't necessary for the purpose.