What information to request before renting or selling in Colombia without violating privacy or exposing yourself to identity theft

Quick answer: To verify a buyer or tenant in Colombia without violating Law 1581 of 2012 (Habeas Data) or exposing your own data to identity theft, apply a staged protocol. During the initial contact, ask only for a name and phone number; during the in-person viewing, check the physical identity document without photographing it; and only at the closing of the deal or formal rental review, request digital copies, always protected with watermarks overlaid and with the processing codes on the reverse side covered.

When I post an ad to rent an apartment or sell a used vehicle, my first impulse is usually to cover my back by asking upfront for their national ID, employment certificate, or even bank statements. However, demanding that amount of sensitive information from strangers in a WhatsApp chat not only scares off legitimate buyers due to mistrust but also creates informal databases vulnerable to identity theft. If you want to see real options right now, you can view apartments and houses on Colombia Move — posting is completely free.

Security and privacy are not mutually exclusive. In this practical guide, we show you how to protect your assets, verify the other party ethically, and comply with Colombian personal data protection regulations.

The dilemma between verifying identity and scaring off buyers with excessive requirements

Asking for too many documents at the wrong time is one of the most common mistakes made by those selling or renting on their own. If you demand a photocopy of a national ID expanded to 150% from an interested party who is just asking about the availability of a property or appliance, it is most likely that they will abandon the conversation and try to find another option.

Honest buyers and tenants also fear identity theft. Providing a digital copy of an identity document to an unverified profile on social media opens the door for scammers to open mobile lines, request digital loans, or commit fraud in their name. For this reason, the data request process must be staggered and respond strictly to the progress level of the negotiation.

What Law 1581 of 2012 (Habeas Data) says about the exchange of data between individuals

In Colombia, the right to Habeas Data is regulated by Law 1581 of 2012. Although we usually associate this rule with large banks or telephone companies, its principles apply to anyone who collects, stores, or processes personal data of third parties.

The Superintendency of Industry and Commerce (SIC) is the authority responsible for overseeing data processing and makes it clear that any collection requires prior, express, and informed authorization. Additionally, Law 2573 of 2026 has strengthened protection mechanisms for citizens who fall victim to identity theft in commercial or telecommunications obligations.

As an individual seller or landlord, you must keep in mind three basic principles:

• Principle of freedom: No one is obligated to give you their personal data without their explicit consent.
• Principle of purpose: You can only request information strictly necessary for the purpose of the business (evaluating payment capacity or formalizing the contract).
• Principle of security: If you receive photos of national IDs or certifications, you are responsible for storing them in a secure place and deleting them if the transaction does not materialize.

The 3-stage protocol: what information to request at each moment

To avoid friction and keep your transactions secure, the ideal approach is to structure data collection in three key moments during the sales or rental process.

Stage 1: Initial contact and inquiry (filter without asking for a national ID)

In the first message or call, the goal is to resolve commercial doubts and filter out curious people without requesting sensitive information. If you handle your conversations carefully, as we explain in our guide on using WhatsApp in ads without receiving spam, you will see that in this initial phase you only need to request:

• Full contact name.
• City of residence or approximate location.
• Usage validation questions (for example: "For how many people are you looking for the property?" or "When do you need to pick up the product?").

Avoid asking for identification numbers, photos of documents, or cash advances in this first interaction.

Stage 2: Showing the good or inspection appointment

When the person demonstrates real interest and you agree to an in-person meeting or video call to review the item or property, it is time to check identities without the need to retain photocopies:

• For rentals or properties: Ask the visitor to show their original national ID upon entering the property to confirm that it matches the person who scheduled the appointment.
• For buying and selling vehicles or valuable items: You can verify the physical document before allowing a test. Look at it, confirm the name and face, but do not take photographs with your mobile phone at that moment.

Stage 3: Closing the deal or formal rental review

Once the offer is accepted or the formal application begins, the request for complete documents is completely legitimate. If it is a rural or vacation home contract, also consult the specific recommendations of our guide to renting holiday villas in Colombia.

In this final stage, it is correct to request:

• Photocopy of the national ID or alien identification card.
• Employment certification or proof of income (for lease contracts).
• Signed data processing authorization form, specifying the purpose of the study.

How to protect documents: data you must cover and recommended watermarks

Both when asking for documents and when sending yours to prove you are the real owner, apply strict digital editing rules to prevent the image from being reused in fraud:

• Cover the processing code: On the back of the Colombian national ID, there is a 10-digit processing number. Cover that code before sharing or receiving a digital image, as it is used for critical online procedures.
• Add a visible watermark: Use any basic editing app to write text diagonally across the image that crosses the document from side to side. Example: "Exclusive copy for property rental study in Colombia - August 2026".
• Use protected PDF format files: Instead of sending images in JPG through open chats, prefer consolidated PDF documents.

What to do if you detect a fake ID or an attempt at identity theft

According to active listings on Colombia Move (August 2026), the home appliances category has 1 active listing. That count describes the available offer, not the security of a negotiation. If you notice inconsistencies—such as a buyer refusing to make a call, names that do not match the destination bank accounts, or visibly edited documents—follow these steps:

1. Suspend negotiations immediately: Do not hand over keys, the vehicle, or the product based on promises of receipts or pending transfers.
2. Do not confront the person aggressively: Simply inform them that the process will not continue due to a lack of data verification.
3. Keep the evidence: Save screenshots of the conversation, phone numbers, and images of the documents provided.
4. Report through official channels: Initiate a formal report for identity theft through the official ¡A Denunciar! (ADenunciar) portal of the Colombian National Police.

Frequently Asked Questions

❓ Is it legal to request a photocopy of an ID (cédula) to lease a property or sell an item in Colombia?

Yes, it is legal as long as there is a clear contractual purpose and the person explicitly authorizes the processing of their personal data under the terms of Law 1581 of 2012.

❓ What data on my ID should I mask before sending it via digital message?

It is recommended to cover the processing number located on the back of the document and leave only the full name and ID number visible for identity validation.

❓ How can I confirm that the person buying or leasing is not using a stolen identity document?

You can perform cross-verification by requesting that the payment transfer or deposit come from a bank account in their same name, or by conducting a brief verification video call.

❓ Where can I report the unauthorized use of personal documents in Colombia?

The report for identity theft or impersonation is filed on the official ¡A Denunciar! portal of the National Police and the Attorney General's Office, in addition to filing a complaint with the SIC.

❓ Why is it not recommended to request bank statements in the first chat message?

Demanding financial documents in the initial contact phase violates the interested party's privacy, generates reasonable distrust in legitimate buyers, and exposes confidential information to unverified profiles.