When Informal Background Checks Become a Legal Risk
In the business world, risk prevention has become an everyday practice. Before hiring, entering into a partnership, or closing a deal, many people believe they are acting diligently by “verifying” the background of third parties.
However, one common—and dangerous—practice continues to occur frequently: consulting and storing third parties’ criminal record information through the National Police of Colombia’s website.
What may appear to be a preventive measure can, in reality, become a serious violation of the fundamental right to personal data protection, with significant legal consequences.
I. A Clear Warning That Many Ignore
The official judicial records inquiry page of the National Police of Colombia contains an express and unequivocal warning:
“Access to the online Judicial Records inquiry service is a permanent service […] so that citizens may verify their own personal judicial information.
The use of the information provided by the National Police of Colombia is limited to personal purposes; any use for a different purpose, such as obtaining an economic benefit or consulting the personal information of a third party, shall be considered improper and will be subject to the initiation of the corresponding legal actions.
The use of the personal information contained on this website by any natural or legal person other than the data subject is expressly prohibited.”
The message leaves no room for interpretation: only the data subject may consult their own information.
II. So, What Is Happening in Practice?
In reality, many individuals and companies:
Consult third parties’ records without authorization
Keep screenshots or PDF files
Incorporate that information into folders, databases, or selection processes
Use it to decide whether to hire, enter into a partnership, or close a business deal
Even if the intention is to “prevent risks,” the means used are unlawful, considering that the official National Police website authorizes consultation only by the data subject and not by third parties.
III. Why Does This Practice Constitute a Violation of Privacy?
In Colombia, the processing of personal data is strictly regulated. Consulting, storing, or using a third party’s judicial records without authorization violates the following:
1. Political Constitution of Colombia – Article 15
It recognizes the fundamental right to habeas data, which includes the right to:
Know
Update
Rectify
Authorize the use of personal information
No one may process personal data without the consent of the data subject, except where expressly permitted by law.
2. Law 1581 of 2012 – Personal Data Protection
This law establishes that all personal data processing requires:
Prior, express, and informed authorization from the data subject
A legitimate and specific purpose
Proportionality and necessity
Judicial records are sensitive personal data, which entails an even higher level of protection.
3. Decree 1377 of 2013
This decree reinforces the obligation to obtain authorization and prohibits the use of data for purposes other than those disclosed to the data subject.
4. Decree 019 of 2012 – Article 94
This is precisely the provision that authorizes the consultation of judicial records, but under one clear condition: solely for the citizen’s own personal verification.
Any other use—such as consulting the records of a third party—undermines the lawful purpose of the system.
IV. What Risks Do Those Who Conduct These Searches Assume?
The consequences are far from minor and may escalate both legally and reputationally:
Investigations by the Superintendence of Industry and Commerce, including the initiation of administrative proceedings for the improper processing of personal data
Administrative sanctions and financial penalties that may directly affect the organization’s financial stability
Constitutional actions (tutelas) for violation of the fundamental right to habeas data
Reputational risk, especially in regulated sectors or before strategic partners
Loss of commercial trust from clients, investors, or counterparties
In this way, a practice that may appear preventive can become a significant legal, financial, and reputational contingency, compromising not only regulatory compliance but also institutional credibility and business sustainability.
V. Do You Need to Verify or Assess Third Parties Without Exposing Yourself to Legal Risks?
At Legal Compliance, we support you through comprehensive due diligence processes aligned with current regulations, combining ethics, strategy, and legal rigor so that you can make sound, secure, and well-founded decisions.
Legal Compliance
Your ally in safe, lawful, and sustainable decisions.