Student accommodation regulation in Colombia (2026)

The short answer

Colombia has no student accommodation act. The closest thing is the contrato de pensión (boarding contract) of Law 820 of 2003; the rest comes from the police code, the fire services and habeas data, as the right over one's own data is called there.

What residences are called there

People speak of university residences, private student residences —the model called PBSA elsewhere— and pensiones or rooms with services. The law defines none of them as an activity, but it classifies urban residential leases "cualquiera que sea la estipulación al respecto" ("whatever is stipulated about it", Law 820, Art. 4); two matter for a residence:

• Compartido (shared): a non-independent part is let and the rest is shared with the landlord or with other tenants.
• De pensión (boarding): a non-independent part of a property that necessarily includes additional services, things or uses and is agreed for less than a year. Either party can end it with ten days' notice and no compensation.

The contract: lease, boarding or lodging

A lease is the contract in which one party grants the enjoyment of a thing and the other pays a set price (Civil Code, Art. 1973). For urban housing, Law 820 of 2003 applies:

• Term: whatever the parties agree; if they agree none, one year (Art. 5).
• Security: cash deposits and other real guarantees cannot be required, not even indirectly (Art. 16).
• Rent review: every twelve months and never above the rise in the consumer price index for the previous year (Art. 20).
• Registration: anyone mainly engaged in letting urban housing in municipalities of more than fifteen thousand inhabitants registers as a landlord (Art. 28).

If the residence is a business providing accommodation and services, the contract can be a commercial hospedaje (lodging agreement) (Commercial Code, Art. 1192), subject to the regulation the Government determines (Art. 1193).

The establishment

The framework is national: the National Code of Security and Citizen Coexistence (Law 1801 of 2016). Before opening, land use must be complied with, the commercial registration must be current and the opening must be reported to the Police; afterwards the security, health and environmental conditions apply, and "para ofrecer los servicios de alojamiento al público u hospitalidad" ("to offer accommodation or hospitality services to the public") the Registro Nacional de Turismo (National Tourism Register) is required (Art. 87).

Fire services inspect fire prevention in public and private buildings and test their fire protection systems every year (Law 1575 of 2012, Art. 42). Land use is set by each municipality.

Data protection

Law 1581 of 2012 applies, regulated by Decree 1377 of 2013, now compiled in Decree 1074 of 2015. The authority is the Superintendence of Industry and Commerce (Art. 19). For a residence that answers on WhatsApp:

• Autorización (consent): prior and informed, by any means that can be checked later (Art. 9). When asking for it, the residence states the purpose, the data subject's rights and its contact details, and keeps the evidence (Art. 12).
• Policy and notice: the residence has a data processing policy; the aviso de privacidad (privacy notice), which points to it, serves when the policy cannot be made available to the data subject (Decree 1377, Arts. 13 to 15).
• Sensitive data: health data is sensitive (Law 1581, Art. 5) and requires explicit consent (Art. 6).
• Processor in another country: sending data to a processor outside Colombia to handle it on the residence's behalf is a transmisión (transmission), not a transfer; it need not be reported to the data subject nor consented to if there is a transmission contract (Decree 1074, Arts. 2.2.2.25.5.1 and 2.2.2.25.5.2).
• National Register of Databases: companies and non-profits with total assets above 100,000 UVT (tax value units) register their databases (Decree 1074, Art. 2.2.2.26.1.2).

A transfer to another controller only goes to a country with an adequate level, save for the exceptions in Art. 26. The SIC's list (External Circular 005 of 2017, section 3.2 of Title V of the Circular Única) includes the European Union member states, Ireland among them, and the United States, among others, and the SIC can review it. Since December 2025 it also accepts the model clauses of the Ibero-American Data Protection Network (External Circular 003 of 2025).

What the rules do not say

Where Bedel comes in

Bedel answers the residence's WhatsApp in the language of whoever writes (languages) and passes to the phone of a person on the team whatever a machine should not decide (escalation to people). Its data is in the European Union, in Ireland, and the AI model runs in the United States under Standard Contractual Clauses. For a residence in Colombia, Bedel would be a processor, and Decree 1074 calls for a transmission contract between them. What changes in the contract and in the processing is discussed before signing.