According to Art. 23 of Decree 1,377, controllers and processors should appoint a person or function within the company that assumes responsibility for the protection of personal data, tasked with reviewing and solving claims made by data subjects. Furthermore, Title VI of Law No. 1,581 establishes the duties of those responsible for data treatment and in charge of data treatment.

Concerns have been raised regarding the effectiveness of online copyright enforcement in Colombia. Digital piracy remains widespread, and the authorities have not significantly reduced the availability of free-to-air devices, community antenna systems, and unlicensed Internet Protocol Television (IPTV) services that enable the large-scale retransmission of otherwise licensed content to non-subscribers. Stakeholders further report that piracy of licensed content via mobile applications continues to expand and constitutes an increasing challenge.

The government of Colombia holds 32.5% shares of Colombia Telecomunicaciones SA ESP, which operates under the brand Movistar and focuses mainly on the telephony and mobile connection businesses. In September 2018, the authorities reported that the State was going to sell its stake in the company, but this has not been the case yet. Some public telecommunication companies exist at the local level, as ETB (which provides services in Bogotá), EPM (in Medellín), and Metrotel (in Barranquilla).

The country does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there has been an obligation of accounting separation since 2009. According to Arts. 64 and 65 of Law No. 1,341 "Issues principles and concepts on the information society and the organization of Information and Communication Technologies (ICT), creates the National Spectrum Agency [...]" (Ley No. 1341 Por la cual se definen principios y conceptos sobre la sociedad de la información y la organización de las Tecnologías de la Información y las Comunicaciones (TIC), se crea la Agencia Nacional de Espectro [...]), the operators must keep separate accounting. They would be subject to specific sanctions if they do not comply with the requirement.
In addition, according to Arts. 9.1.2.1. and 9.1.2.2. of Resolution 5050 of 2016 (as amended by Art. 1 of Resolution No. 5589 of 2019), Telecommunications Network and Service Providers and/or Pay TV Operators are obliged to adopt separate accounting schemes in compliance with Art. 22 (numeral 19) and Art. 64 (numeral 8) of Law No. 1,341 of 2009.

Colombia has a telecommunications authority: the Communications Regulation Commission (CRC, Comisión de Regulación de Comunicaciones). However, it is reported that the decision-making process of this entity is not fully independent from the government.

According to Art. 26 of Law No. 1,581, cross-border transfer of personal data is forbidden unless it is made to a country that offers adequate levels of data protection, as defined by the Colombian data protection authority. The prohibition does not apply in certain cases, including when the data subject authorises the cross-border transfer or when medical data is required for health or public hygiene reasons. According to the law, the institution in charge, "Superintendencia de Industria y Comercio" (SIC), establishes the standards regarding international data transfers.
Pursuant to Section 3.2 of External Circular No. 005/2017, as amended by External Circular No. 002/2018, the jurisdictions recognised as providing an adequate level of data protection include EU Member States, as well as Australia, Costa Rica, Japan, Iceland, Norway, Peru, Serbia, the Republic of Korea, the United Kingdom, and the United States.

Art. 5 of Law No. 1,266 establishes that a personal data transfer between data bank operators is permitted when authorisation is obtained from the data subject or when the destination database has the same purpose as the operator that delivers the data. If the receiver of the data is a foreign data bank, the delivery without authorisation must be done with a written record and due verification that the laws of the recipient of the information offer guarantees for the protection of the rights of the data subject.

Pursuant to Art. 4 of Decree No. 1,704, telecommunications providers must keep and store for a period of five years subscribers' personal information, such as identity, billing address, and connection type. This information must be available to the Attorney General or any competent authority in the context of a criminal investigation.

Art. 20 of Law No. 80 establishes the principle of reciprocity for the participation of foreign investors in public procurement, under which foreign bidders are entitled to the same treatment that Colombian companies receive in the countries of origin of the foreign bidders.
In addition, Art. 6 of Law No. 1,150 of 2007, together with Art. 3 of Decree No. 1,510 of 2013, requires bidders established in Colombia (including foreign branches) to be enrolled in the Single Bidders Register (Registro Único de Proponentes, RUP) in order to contract with the State. As a general rule, registration in the RUP operates as a condition for participation in public procurement procedures. However, the most recent WTO Trade Review indicates that foreign firms established abroad may participate without RUP registration.
The RUP is intended to facilitate access to procurement opportunities and functions as an ex ante mechanism for verifying legal, administrative, and related eligibility requirements prior to participation in competitive tendering processes. The enrolment fee set in 2024 is COP 741,000 (approx. USD 200), which has been reported as a potential obstacle to participation in government procurement.

Art. 12.5 (Chapter III) of Law No. 590 states that micro, small and medium enterprises (MSMEs) are preferred under equal conditions (price, quality, capacity of supply, and service) in public tenders.

Pursuant to Law No. 816, public administration entities that, under the applicable contracting regime, must select contractors through tenders, calls for bids, or public competitions are required to apply objective evaluation criteria that favour domestic industry. Art. 2 provides that bids offering goods and services of Colombian origin benefit from a margin of preference of 10% to 20%, while bids offering foreign goods and services that incorporate inputs of Colombian origin benefit from a margin of preference of 5% to 15%. The concept of “origin” for services was amended by Decree No. 680 of 2021 to encompass the domestic goods and labour required to supply those services.

Art. 35 of Law No. 2069 of 2020 establishes the tie-break mechanism applicable to public procurement processes. Where two or more bids obtain the same total score, the contracting entity must apply a series of criteria sequentially and exclusively, in the order listed, while ensuring consistency with Colombia’s international commitments, until the tie is resolved. The first criterion is a preference for national goods and services over foreign goods and services. Other criteria include the preference for companies employing at least 10% of the workforce that is indigenous, Black/Afro-Colombian, Raizal, Palenquero, and Gypsy populations, and a preference for bids submitted by SMEs, cooperatives, or mutual associations.

There have been frequent complaints about the lack of transparency and rule changes during the award of major government contracts. It has been reported that, despite Law No. 80, transparency, fairness, and truly competitive bidding conditions in many tenders remain uncertain. These factors remain significant market access barriers for some companies interested in public sector contracts.

Colombia is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA). However, the country has been an observer of the WTO GPA since 1996.

It is reported that the provision of data processing and information services in Colombia necessitates the establishment of a formal commercial presence.