Colombia does not yet have an Open banking regulatory model; However, with Law 1955 of 2019, the National Government was empowered to create a regulatory sandbox -for a term of two years- that would allow evaluating and measuring the behavior of the markets and the level of financial innovation in the country, before adopting a definitive model. In use of the powers given by the legislator, Decree 1234 of 2020 was issued, in which the objectives, requirements and stages of operation of the controlled test space were generally set, as a tool to promote innovation in the provision of financial services and make it easier for supervisory and regulatory authorities to identify new financial developments. In this scenario, this article argues that, although the open banking rules in force in Colombia are transitory, the regulator cannot forget when defining the regulatory model that it will adopt that the main risks of its implementation lie in ensuring compliance with the rules regarding the protection of the rights to personal privacy, habeas data and personal data. In this sense, it is necessary to complement the personal data protection regime to fill some gaps related to the quality and responsibility of the financial and non-financial agents that participate in this new form of financial innovation.