Colombia has signed but not ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Under Arts. 4, 5 and 12–14 of Decree No. 925/2013, products imported under “special market conditions”, including used, imperfect, repaired, rebuilt, refurbished, remanufactured, repowered, discontinued and second-hand goods, require a prior import licence. Applications are evaluated and decided by the Import Committee, while the competent authorities may require evidence of functionality, certified useful life, environmental impact or the contribution of the goods to Colombia’s technological development. The requirement applies horizontally and therefore covers computers, mobile phones, network equipment and other ICT goods when imported in any of those conditions. Under Art. 18, the National Registry of Domestic Producers may also be consulted in evaluating the application. Remanufactured goods covered by an applicable trade agreement are exempt where the agreement expressly provides that no licence is required and its conditions are met.

It is reported that Decree No. 2025/2015 creates burdensome restrictions and administrative requirements for trade in mobile phones. The Decree establishes measures to control the import and export of intelligent mobile phones, cellular mobile phones, and their parts, susceptible to classification under Customs Tariff subheading 8517.12.00.00 and 8517.70.00.00, as part of its strategy to address the theft of mobile phones.
In particular, the decree mandates that each mobile phone have a government-issued International Mobile Equipment Identity (IMEI) verification certificate at the time of import and requires all importers and exporters to pre-register with the National Police in order to trade in mobile phones.
Chapter I of Decree No. 2025 establishes the import conditions of mobile phones. According to Art. 3, mobile phones whose IMEI is registered in the databases referred to in Art. 106 of No. Law 1,453 of 2011 may not be imported. But, importation is permitted if: (a) it is an IMEI reported in the positive database, (ii) in the case of import in compliance with a guarantee or (iii) the re-import of previously exported phones. Also, intelligent mobiles can be imported if the travellers carry them when entering the national territory as a personal possession (and no more than three units). Importation is also allowed under the modality of postal traffic and urgent shipments if it is just one mobile/intelligent phone that fulfils customs regulations."
Art. 1 of Decree No. 2,142 amended Art. 3 of Decree No. 2025/2015 (Chapter I), yet the conditions for importing mobile phones remain largely unchanged. While these restrictions predate the amendment, Decree No. 2,142 introduced a more lenient regime allowing the import under the modality of postal traffic and urgent shipments if it is just one mobile/intelligent phone that fulfils customs regulations.

It is reported that slow customs-clearance procedures in Colombia hamper both import and export activities. Earlier reports also identified significant delays in implementing customs reforms that would allow traders to submit electronic copies of invoices instead of physical documents. Those reforms were originally scheduled for implementation under Decree No. 390 of 2016 and were subsequently postponed by Decree No. 349 of 2018. More recent reports indicate that the electronic-document system had still not been implemented by 2025 and that the relevant digital customs system remained under development.

According to Art. 7 of Decree No. 2025/2015, the export of smartphones/mobile phones is prohibited, with some exceptions:
- Export is allowed if travellers carry the phones when leaving the national territory as personal possession (and no more than three units);
- In the case of temporary export;
- In case of definitive export, when they are considered waste electrical or electronic equipment;
- When the export of smartphones or mobile phones originates from a free zone within Colombia, and the products have been transformed, assembled, stored, repaired, or serviced by users of the free zone.
In addition, Art. 4 of Decree No. 2,142 modified Art. 7 of Decree No. 2,025 (chapter II), but export conditions for mobile phones remain in place.

Section 9 of Decree No. 1074 of 2015 regulates the conformity assessment procedure. There is a mandatory certification of cellular devices.
According to Art. 2.2.1.7.9.2 of the Decree, the country accepts a Self-Declaration of Conformity (SDoC). However, a testing laboratory recognised by the regulator ICONTEC (“Instituto Colombiano de Normas Técnicas y Certificación”) must test the equipment, and the supplier must register the equipment with the regulator.
Circular No. 060 deals with safety levels regarding human exposure to radiofrequency electromagnetic fields and lists the following products to be homologated: fixed-wireline desktop and wall-mounted, cellular-mobile, cellular-fixed, PCS-mobile, PCS-fixed, dual-cellular PCS, and satellite.

According to Art. 253 of the Decree No. 1165/2019, the value of products delivered by postal traffic must not exceed USD 2,000. Postal traffic includes online purchases delivered to Colombia via the Official Postal Operator Network. When the value exceeds USD 2,000, the goods must be subject to standard import procedures (Art. 258).

Pursuant to Art. 3 of Decree 2025/2015, imports under the postal traffic and express shipments regime may include a maximum of one smartphone or mobile (cellular) telephone per shipment, provided that the item complies with the applicable customs requirements and the addressee is a natural or legal person. The Decree also prohibits split or fragmented shipments made in the name of the same addressee.
For these purposes, postal traffic refers to correspondence, postal parcels, or online purchases that enter Colombia through the network of the Official Postal Operator.

According to Art. 4 of Resolution No. 3,596, in the case of sales made through the Internet (virtual payment), airlines and travel agencies may charge an administrative fee different from the fees enshrined in the Resolution, provided that they inform the fee and the sales conditions to the aeronautical authority. This rule provides a different regime for online payments in the aeronautical realm, and it has been suggested that this may hamper online purchases.

According to Resolution No. 912, telecom subscribers must provide telecom concessionaires with their name, address, contact number and ID number. The police duplicate this database. Telecommunications service providers authorised to operate must “allow remote queries” to subscriber’s data “via the web through VPN”, which must contain the following information: complete names or registered corporate or trade name; identification number and type or tax identification (for legal entities); address; telephone number; city of residence; mobile number or fixed line number; “ID and FLOTA number” if any; activation date. In case of changes, telecommunications service providers must send updates to DIJIN ("Dirección de Investigación Criminal e INTERPOL de la Policía Nacional") every month (Art. 1 and Annex I).

The government of Colombia holds 32.5% shares of Colombia Telecomunicaciones SA (COLTEL) ESP, which operates under the brand Movistar and focuses mainly on the telephony and mobile connection businesses. In September 2018, the authorities reported that the State was going to sell its stake in the company, but this has not been the case yet. Some public telecommunication companies exist at the local level, as ETB (which provides services in Bogotá), EPM (in Medellín), and Metrotel (in Barranquilla).

The country does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there has been an obligation to separate accounting since 1997. Under Art. 2.9.1.2 of Resolution CRT No. 87 of 1997, vertically integrated public switched telephone network operators had to maintain separate accounts for long-distance services and for local, extended-local and rural mobile telephone services. The accounts had to distinguish the assets, liabilities, revenues, costs and expenses attributable to the respective services.
In addition, according to Arts. 9.1.2.1. and 9.1.2.2. of Resolution 5050 of 2016 (as amended by Art. 1 of Resolution No. 5589 of 2019), Telecommunications Network and Service Providers and/or Pay TV Operators are obliged to adopt separate accounting schemes in compliance with Art. 22 (numeral 19) and Art. 64 (numeral 8) of Law No. 1,341 of 2009.

Art. 5 of Law No. 1,266 establishes that a personal data transfer between data bank operators is permitted when authorisation is obtained from the data subject or when the destination database has the same purpose as the operator that delivers the data. If the receiver of the data is a foreign data bank, the delivery without authorisation must be done with a written record and due verification that the laws of the recipient of the information offer guarantees for the protection of the rights of the data subject.

According to Art. 26 of Law No. 1,581, cross-border transfer of personal data is forbidden unless it is made to a country that offers adequate levels of data protection, as defined by the Colombian data protection authority. The prohibition does not apply in certain cases, including when the data subject authorises the cross-border transfer or when medical data is required for health or public hygiene reasons. According to the law, the institution in charge, "Superintendencia de Industria y Comercio" (SIC), establishes the standards regarding international data transfers.
Pursuant to Section 3.2 of External Circular No. 005/2017, as amended by External Circular No. 002/2018, the jurisdictions recognised as providing an adequate level of data protection include EU Member States, as well as Australia, Costa Rica, Japan, Iceland, Norway, Peru, Serbia, the Republic of Korea, the United Kingdom, and the United States.

Pursuant to Art. 4 of Decree No. 1,704, telecommunications providers must keep and store for a period of five years subscribers' personal information, such as identity, billing address, and connection type. This information must be available to the Attorney General or any competent authority in the context of a criminal investigation.