Habeas data and AI agents on WhatsApp: what Colombia’s Law 1581 requires

An AI agent answering WhatsApp collects personal data all day: a name, a phone number, an ID number for a quote, a delivery address, sometimes the reason for a medical appointment. Colombia’s Law 1581 of 2012 has no chapter on artificial intelligence, and it does not need one: the Superintendence of Industry and Commerce (SIC) says in its External Circular 002 of 2024 that the data laws are technology neutral and apply to any AI system.

Who is the Controller and who is the Processor?

The law defines two roles (article 3). The Controller (Responsable) decides on the database and the processing. The Processor (Encargado) processes the data on the Controller’s behalf.

When your company puts an agent in front of its customers, your company is the Controller: it decides what is asked, what for and how long it is kept. The platform running the agent is the Processor. For Meteor this is written in its Terms (clause 16.1, in Spanish): the customer acts as Controller and Meteor as Processor, handling data under the customer’s documented instructions.

What does the law require?

Duty	Where it is	What it means in a chat
Prior, express and informed authorization	Law 1581, arts. 3 and 9	Ask for it up front, in a way that can be checked later
Disclose the purpose and the rights	Law 1581, art. 12	Say what the data is for, which rights apply and how to reach you
Silence is not consent	Decree 1377, art. 7	No reply does not count as a yes
Answer queries	Law 1581, art. 14	Within 10 business days, extendable by 5
Answer complaints	Law 1581, art. 15	Within 15 business days, extendable by 8
Sensitive data has its own rules	Law 1581, arts. 5 and 6	Health, biometrics and others: explicit authorization and optional answers
Data of children and adolescents	Law 1581, art. 7; Decree 1377, art. 12	Prohibited except public data or under the decree’s requirements, including the legal representative’s authorization
Security	Law 1581, art. 4(g)	Technical, human and administrative measures against unauthorized access

What does the SIC circular add for AI?

External Circular 002 of August 21, 2024 is addressed to anyone processing personal data in AI systems, whether Controller or Processor. Its main instructions:

1. Weigh it before processing. Processing must be suitable (it achieves the goal), necessary (no less invasive measure is equally effective), reasonable and proportionate.
2. Precaution. If the potential harm is uncertain, refrain or adopt preventive measures.
3. Risk management. Identify, measure, control and monitor the risks of the processing.
4. Privacy impact assessment when high risk to data subjects is likely, describing the operations, assessing the risks and listing the measures to prevent them.
5. Data quality. Truthful, complete, accurate, up to date, verifiable and understandable.
6. Being online does not make data public. Data accessible to the public cannot be processed without authorization just because it was found on the internet.

What does this look like in a conversation?

A flow that complies without scaring the customer fits in four steps:

1. The first message informs. Who you are, what you will use their information for and where your data policy is.
2. The customer’s reply is stored. Authorization must be verifiable later (article 9), so it is not enough that it happened in the chat: keep a record on the contact, with the date and what they were told.
3. The agent asks only for what it needs. If a quote only needs a name and a city, the ID number is excess. That is the circular’s necessity test, applied question by question.
4. A data query or complaint goes to a person. The agent can receive it, but your team meets the 10 or 15 business day deadline, with the real database.

How Meteor does it

• Roles in writing. Meteor’s Terms state that the customer is Controller and Meteor is Processor, and that the customer obtains the data subjects’ authorization. Clause 16.2 adds that a generic prior authorization does not by itself cover processing with AI.
• You tell the Met how to greet. The Met’s prompt is content in your workspace: that is where you instruct it to make the first message state the purpose and link your policy.
• The record, on the contact. The Met can leave a note or a tag on the contact in the CRM when the customer authorizes. Do that rather than relying on the history alone: clause 17.1 of the Terms keeps conversation records for 15 days, unless the law requires another period or you configure a different retention.
• Handing over to a person is a Met tool, not a prompt trick: the WhatsApp agent page explains when it is used and how context carries over.
• Published security. The guide to AI agent security summarizes the controls Meteor publishes in its Privacy Policy and Terms.

What Meteor does not do for you: write your policy, decide your purposes or answer a complaint before the SIC. That stays with the Controller.

What this is not

This is not legal advice. The rules are cited by number from their official text, accessed on October 28, 2026, so you know what to review with your lawyer. If your operation handles health data, data about minors or credit information, professional review is not optional.