According to Art. 23 of Decree 1,377, controllers and processors should appoint a person or function within the company that assumes responsibility for the protection of personal data, tasked with reviewing and solving claims made by data subjects. Furthermore, Title VI of Law No. 1,581 establishes the duties of those responsible for data treatment and in charge of data treatment.

Art. 44 of Statutory Law No. 1621 stipulates that telecommunications service operators are obliged, upon request and within the framework of an authorised operation and insofar as technically feasible, to provide intelligence and counterintelligence bodies with the communication histories of the relevant telephone subscribers, the technical identification data of the subscribers under scrutiny, the location of the cells in which their terminals are situated, and any other information that may assist in determining their whereabouts. These bodies must ensure the security of the information received and, for that purpose, must limit their requests to data covering a period not exceeding five years, with such requests to be submitted in writing by the Directors of the intelligence bodies or their duly appointed delegates. Art. 3 establishes that intelligence and counterintelligence functions are undertaken by designated units of the Armed Forces and the National Police, the Financial Information and Analysis Unit (UIAF), and any other bodies empowered by law. Despite the safeguards found in Art. 4, 5, and 15, these requests do not require a court order or warrant.

A basic legal framework on intermediary liability for copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

Decree No. 1,630 creates a national registry of mobile phones through the adoption of two databases. The negative database contains the IMEI (International Mobile Equipment Identity) of the devices that have been reported as stolen or lost, both in Colombia and abroad, while the positive database includes the mobile equipment imported or legally manufactured in Colombian territory. The latter connects the IMEI with the identity of the user, who is required to provide the telecommunication operators (or mobile telecommunications networks and services providers) with their full name, type and identity document number, address and telephone number. Although there is no mandatory registration of SIM cards, the IMEIs are associated with a specific user. Art. 5 of Decree No. 1,630 states that telecommunications providers must bear the costs of the system that supports the positive and negative databases, which must be managed by an independent legal entity and should guarantee the quality of the service. More regulation on the databases is contained in Resolution No. 3,128.

There have been frequent complaints about the lack of transparency and rule changes during the award of major government contracts. It has been reported that, despite Law No. 80, transparency, fairness, and truly competitive bidding conditions in many tenders remain uncertain. These factors remain significant market access barriers for some companies interested in public sector contracts.

Colombia is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA). However, the country has been an observer of the WTO GPA since 1996.

It is reported that the provision of data processing and information services in Colombia necessitates the establishment of a formal commercial presence.

It is reported that patent applicants who are not resident in Colombia must appoint an agent in the country by submitting a simple power of attorney. Any attorney registered in Colombia may act as the appointed agent.

Colombia has a copyright regime under Law No. 23. However, the exceptions do not follow the fair use or fair dealing model, therefore limiting the lawful use of copyrighted work by others. Arts. 31-44 list the exceptions, which include the use of literary or artistic works or parts thereof as illustrations in works intended for educational purposes; and the reproduction, distribution, and communication to the public of news or other information relating to facts or events that have been publicly disseminated by the press or by broadcasting; among others.
Moreover, Colombia is a member of the Andean Community of Nations and is subject to Decision 351, issued in 1993. Art. 22 of the Decision sets forth a list of mandatory exceptions in the internal market but also allows the adoption of additional exceptions in the domestic law of members, as long as they comply with the international standards of the so-called three-step test.

Concerns have been raised regarding the effectiveness of online copyright enforcement in Colombia. Digital piracy remains widespread, and the authorities have not significantly reduced the availability of free-to-air devices, community antenna systems, and unlicensed Internet Protocol Television (IPTV) services that enable the large-scale retransmission of otherwise licensed content to non-subscribers. Stakeholders further report that piracy of licensed content via mobile applications continues to expand and constitutes an increasing challenge.

Art. 20 of Law No. 80 establishes the principle of reciprocity for the participation of foreign investors in public procurement, under which foreign bidders are entitled to the same treatment that Colombian companies receive in the countries of origin of the foreign bidders.
In addition, Art. 6 of Law No. 1,150 of 2007, together with Art. 8 of Decree No. 1,510 of 2013, requires bidders established in Colombia (including foreign branches) to be enrolled in the Single Bidders Register (Registro Único de Proponentes, RUP) in order to contract with the State. As a general rule, registration in the RUP operates as a condition for participation in public procurement procedures. However, the most recent WTO Trade Review indicates that foreign firms established abroad may participate without RUP registration.
The RUP is intended to facilitate access to procurement opportunities and functions as an ex ante mechanism for verifying legal, administrative, and related eligibility requirements prior to participation in competitive tendering processes. The enrolment fee set in 2024 is COP 741,000 (approx. USD 200), which has been reported as a potential obstacle to participation in government procurement.

Art. 12.5 (Chapter III) of Law No. 590 states that micro, small and medium enterprises (MSMEs) are preferred under equal conditions (price, quality, capacity of supply, and service) in public tenders.

Art. 35 of Law No. 2069 of 2020 establishes the tie-break mechanism applicable to public procurement processes. Where two or more bids obtain the same total score, the contracting entity must apply a series of criteria sequentially and exclusively, in the order listed, while ensuring consistency with Colombia’s international commitments, until the tie is resolved. The first criterion is a preference for national goods and services over foreign goods and services. Other criteria include the preference for companies employing at least 10% of the workforce that is indigenous, Black/Afro-Colombian, Raizal, Palenquero, and Gypsy populations, and a preference for bids submitted by SMEs, cooperatives, or mutual associations.