The SIC’s Data Protection Reform: Who Answers Now When a Debtor Claims Identity Theft?

Colombia is seeing a sustained rise in identity theft: more than one third of Colombians report having been the victim of some form of fraud in the past year, according to DataCrédito Experian. In response, the Superintendency of Industry and Commerce (SIC — Colombia’s data protection and consumer authority) has published a draft resolution updating the rules on credit bureau reporting. It is worth reading closely, because it does not only protect consumers: it also adjusts the obligations of companies that extend credit and collect their receivables.

At Trébol Jurídico, we explain in practical terms what changes for your company and how to prepare before the reform takes full effect on November 20, 2026.

1. What the SIC’s Draft Resolution Updates

The SIC is amending Title V of its Circular Única (Consolidated Circular) to align it with Law 2573 of 2026 and Law 2157 of 2021. The three changes most relevant to collection management are:

• Suspension of collection upon an identity theft claim: when a debtor reports having been impersonated, the company must suspend collection (principal, interest, and collection costs) while the case is resolved.
• Dynamic burden of proof: it is no longer the debtor who must prove they did not enter into the agreement; it is the company that must establish that the onboarding and the obligation are legitimate.
• Positive administrative silence: if the claim is not answered within the legal deadline, it is deemed resolved in the debtor’s favor. Responding on time is no longer just good practice — it is decisive.

Added to this is the mandatory “Víctima de Falsedad Personal” (Victim of Personal Identity Fraud) flag in credit bureaus, which cannot affect the data subject’s credit rating, along with the blocking of negative reports where there is no adequate authorization on file.

2. What Should You Review in Your Operation?

When a debtor claims identity theft, the answer is that the creditor company is the one who must respond. It is the creditor that must prove the debt is legitimate, and it is only protected if it documented the obligation properly and addressed the claim on time. For that reason, more than an imminent risk, the reform highlights points worth putting in order ahead of time:

• Whether you maintain full traceability of each obligation: contracts, data processing authorization, and identity verification.
• Whether your receivables claims are answered within the legal deadlines, so as not to expose yourself to positive administrative silence.
• Whether you report to credit bureaus with documented authorization in every case.
• Whether your team can distinguish a genuine case of identity theft from a claim used to delay a legitimate payment, and knows how to substantiate each situation.

3. How to Prepare

1. Document the full traceability of every obligation. That evidence is, today, the foundation of a solid collection case.
2. Respond to every identity theft claim within the legal deadline, with technical support and not as an automatic reaction.
3. Verify internally the merits of the alleged identity theft before suspending or correcting.
4. Clean up your authorizations and credit bureau reports so that every report is properly backed.
5. Rely on specialized legal support when the case calls for it.

4. One Additional Change: International Data Transfers

The same draft resolution expands the list of countries deemed to provide an adequate level of data protection for international transfers, adding Brazil, Ecuador, Kenya, Panama, and South Africa. In practice, this facilitates the flow of information with partners in those countries under equivalent standards and reduces administrative burdens. If your company shares data with suppliers or affiliates abroad, this is a point worth reviewing with your compliance team.

How Trébol Supports You

At Trébol Jurídico, we apply a rigorous documentation and validation filter to every debtor entering our recovery process. We know how to tell a genuine victim of identity theft from a claim that is simply buying time, and we structure collection with the traceability that the new burden of proof demands. The goal is straightforward: that your company recovers its money with solid backing, not improvisation.