AI and customer data: if you put your customers' personal data into an artificial intelligence tool, you are still responsible under Colombian law. You need their prior authorization, you must tell them what you use their data for, you must protect it and, since 2024, you should take into account the guidelines of the Superintendence of Industry and Commerce (SIC) for AI systems.
This guide summarizes the essentials with an 8-step list. It is not legal advice: for your specific case, consult a lawyer.
Which law applies to AI and customer data?
Two rules.
The first is Law 1581 of 2012, Colombia's general personal data protection regime. The second is the SIC's External Circular 002 of August 21, 2024. The SIC is the data protection authority, and the circular sets guidelines for processing personal data in AI systems: when they are developed, deployed or used (INCP).
The circular does not create a new law: it tells whoever processes data how to apply the existing one when AI is involved.
Who is the "controller" and who is the "processor"?
Law 1581 distinguishes two roles (article 3). The controller (responsable) decides on the database and its processing: normally, your business. The processor (encargado) processes data on the controller's behalf: it can be a vendor that handles data for you.
If you use an AI tool with your customers' data, ask what role that vendor plays, what it does with the information and whether it can use it to train its models. Get it in writing and compare it with its contract.
What do you need before using the data?
- Prior, express and informed authorization. It is the data subject's consent to the processing (articles 3 and 9). It must be possible to consult it later.
- Clear information. When asking for it, you must say what the data will be used for, what the person's rights are and who you are, with your address and phone number (article 12).
- Keep proof. You must keep a copy of the authorization (article 17).
- Security. Data needs technical and administrative measures against loss or unauthorized access (articles 4 and 17).
All of this applies equally whether the tool is a spreadsheet or an AI assistant. The law does not change: the risk does.
What does the SIC specifically ask for with AI?
According to a summary by the law firm Holland & Knight (source), the circular asks for:
- Secure environments that comply with the rules before processing any data, even before collecting it.
- Applying the principles of necessity, suitability, reasonableness and proportionality: use only the data you really need.
- A privacy impact assessment, with the minimum content defined by the circular.
- Considering differential privacy techniques, which allow data analysis without identifying people (the circular recommends it).
Other analyses of the same text highlight demonstrated accountability: having a written policy is not enough, you must be able to show that you comply (Cuatrecasas). The official text is on the SIC electronic site.
Which 8 steps should you follow before using AI with customer data?
- Take inventory. List what personal data you have and where it is.
- Define the purpose. Write down why you will use AI and what data it needs.
- Reduce the data. If you can remove names, ID numbers or phones, remove them before sending the text.
- Ask for authorization with a clear notice and keep the proof.
- Review the vendor. Ask where it processes the information, whether it trains on your data and what security measures it offers.
- Assess the risk. Write down what could go wrong and how you avoid it (the circular asks for an impact assessment).
- Limit access. Only the people who need it should be able to use the tool.
- Review from time to time. Tools change; your assessment should too.
When should you not use AI with real data?
Sensitive data and minors' data get especially strict treatment.
Sensitive data is data that affects privacy or can lead to discrimination, such as health or biometric data (article 5), and processing data of children and adolescents is prohibited, except for data of a public nature (article 7). If your case involves that data, do not use an AI tool without legal advice.
How do we handle it at Mokev?
Two examples from our own site. The AI provider key for our website assistant lives only on the server and does not reach the browser. And the automatic translation of digital cards sends the provider only the card's public text (description, category, products and link names), not the owner's contact details.
If you want to bring AI into your business without exposing your customers' data, see our work in consulting and custom software, or tell us about your case.
Frequently asked questions
Can I paste my customers' data into an AI chatbot?
It depends on whether you have authorization for that use and on what the vendor does with the information. A prudent practice is to remove identifying data before pasting the text.
What is demonstrated accountability?
It is the principle that having policies is not enough: you must be able to show with evidence that you comply, for example with stored authorizations and documented assessments.
Is the SIC circular a new law?
No. It is an instruction from the data protection authority to apply existing laws (Law 1581 of 2012 and Law 1266 of 2008) when AI systems are used.
What is personal data?
Any information that identifies or can identify a person: name, ID number, phone, email, photos. If you can reach a specific person with it, treat it as personal data.
Does this replace a lawyer's advice?
No. It is a general guide based on the law and on public SIC guidelines. For audits, contracts or sensitive data, consult a specialist lawyer.
