Colombia has signed but not ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Colombia enacted Law No. 527 of 1999, drawing upon the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Colombia enacted Decree No. 2,364 of 2012, drawing upon the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Art. 44 of Statutory Law No. 1621 stipulates that telecommunications service operators are obliged, upon request and within the framework of an authorised operation and insofar as technically feasible, to provide intelligence and counterintelligence bodies with the communication histories of the relevant telephone subscribers, the technical identification data of the subscribers under scrutiny, the location of the cells in which their terminals are situated, and any other information that may assist in determining their whereabouts. These bodies must ensure the security of the information received and, for that purpose, must limit their requests to data covering a period not exceeding five years, with such requests to be submitted in writing by the Directors of the intelligence bodies or their duly appointed delegates. Art. 3 establishes that intelligence and counterintelligence functions are undertaken by designated units of the Armed Forces and the National Police, the Financial Information and Analysis Unit (UIAF), and any other bodies empowered by law. Despite the safeguards found in Art. 4, 5, and 15, these requests do not require a court order or warrant.

A basic legal framework on intermediary liability for copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

Decree No. 1,630 creates a national registry of mobile phones through the adoption of two databases. The negative database contains the IMEI (International Mobile Equipment Identity) of the devices that have been reported as stolen or lost, both in Colombia and abroad, while the positive database includes the mobile equipment imported or legally manufactured in Colombian territory. The latter connects the IMEI with the identity of the user, who is required to provide the telecommunication operators (or mobile telecommunications networks and services providers) with their full name, type and identity document number, address and telephone number. Although there is no mandatory registration of SIM cards, the IMEIs are associated with a specific user. Art. 5 of Decree No. 1,630 states that telecommunications providers must bear the costs of the system that supports the positive and negative databases, which must be managed by an independent legal entity and should guarantee the quality of the service. More regulation on the databases is contained in Resolution No. 3,128.

According to Resolution No. 912, telecom subscribers must provide telecom concessionaires with their name, address, contact number and ID number. The police duplicate this database. Telecommunications service providers authorised to operate must “allow remote queries” to subscriber’s data “via the web through VPN”, which must contain the following information: complete names or registered corporate or trade name; identification number and type or tax identification (for legal entities); address; telephone number; city of residence; mobile number or fixed line number; “ID and FLOTA number” if any; activation date. In case of changes, telecommunications service providers must send updates to DIJIN ("Dirección de Investigación Criminal e INTERPOL de la Policía Nacional") every month (Art. 1 and Annex I).

Colombia's slow customs clearance procedures are reportedly hampering import and export activities. In addition, there have been reports that Colombia has experienced significant delays in implementing crucial customs reforms that would allow traders to submit copies of invoices electronically instead of physical documents.

It is reported that Decree No. 2025/2015 creates burdensome restrictions and administrative requirements for trade in mobile phones. The Decree establishes measures to control the import and export of intelligent mobile phones, cellular mobile phones, and their parts, susceptible to classification under Customs Tariff subheading 8517.12.00.00 and 8517.70.00.00, as part of its strategy to address the theft of mobile phones.
In particular, the decree mandates that each mobile phone have a government-issued International Mobile Equipment Identity (IMEI) verification certificate at the time of import and requires all importers and exporters to pre-register with the National Police in order to trade in mobile phones.
Chapter I of Decree No. 2025 establishes the import conditions of mobile phones. According to Art. 3, mobile phones whose IMEI is registered in the databases referred to in Art. 106 of No. Law 1,453 of 2011 may not be imported. But, importation is permitted if: (a) it is an IMEI reported in the positive database, (ii) in the case of import in compliance with a guarantee or (iii) the re-import of previously exported phones. Also, intelligent mobiles can be imported if the travellers carry them when entering the national territory as a personal possession (and no more than three units). Importation is also allowed under the modality of postal traffic and urgent shipments if it is just one mobile/intelligent phone that fulfils customs regulations."
Art. 1 of Decree No. 2,142 amended Art. 3 of Decree No. 2025/2015 (Chapter I), yet the conditions for importing mobile phones remain largely unchanged. While these restrictions predate the amendment, Decree No. 2,142 introduced a more lenient regime allowing the import under the modality of postal traffic and urgent shipments if it is just one mobile/intelligent phone that fulfils customs regulations.

Art. 2.2.19.3 of Decree No. 681 on national audiovisual work for users in Colombia, which implements Art. 154 of the National Development Plan 2018-2022, requires video-on-demand (VOD) platforms that operate in Colombia (such as Amazon Prime, Netflix, HBO, among others) to create an exclusive section that highlights and compiles audiovisual works of Colombian origin.

According to Art. 7 of Decree No. 2025/2015, the export of smartphones/mobile phones is prohibited, with some exceptions:
- Export is allowed if travellers carry the phones when leaving the national territory as personal possession (and no more than three units);
- In the case of temporary export;
- In case of definitive export, when they are considered waste electrical or electronic equipment;
- When the export of smartphones or mobile phones originates from a free zone within Colombia, and the products have been transformed, assembled, stored, repaired, or serviced by users of the free zone.
In addition, Art. 4 of Decree No. 2,142 modified Art. 7 of Decree No. 2,025 (chapter II), but export conditions for mobile phones remain in place.

Section 9 of Decree No. 1074 of 2015 regulates the conformity assessment procedure. There is a mandatory certification of cellular devices.
According to Art. 2.2.1.7.9.2 of the Decree, the country accepts a Self-Declaration of Conformity (SDoC). However, a testing laboratory recognised by the regulator ICONTEC (“Instituto Colombiano de Normas Técnicas y Certificación”) must test the equipment, and the supplier must register the equipment with the regulator.
Circular No. 060 deals with safety levels regarding human exposure to radiofrequency electromagnetic fields and lists the following products to be homologated: fixed-wireline desktop and wall-mounted, cellular-mobile, cellular-fixed, PCS-mobile, PCS-fixed, dual-cellular PCS, and satellite.

According to Art. 26 of Law No. 1,581, cross-border transfer of personal data is forbidden unless it is made to a country that offers adequate levels of data protection, as defined by the Colombian data protection authority. The prohibition does not apply in certain cases, including when the data subject authorises the cross-border transfer or when medical data is required for health or public hygiene reasons. According to the law, the institution in charge, "Superintendencia de Industria y Comercio" (SIC), establishes the standards regarding international data transfers.
Pursuant to Section 3.2 of External Circular No. 005/2017, as amended by External Circular No. 002/2018, the jurisdictions recognised as providing an adequate level of data protection include EU Member States, as well as Australia, Costa Rica, Japan, Iceland, Norway, Peru, Serbia, the Republic of Korea, the United Kingdom, and the United States.

Art. 5 of Law No. 1,266 establishes that a personal data transfer between data bank operators is permitted when authorisation is obtained from the data subject or when the destination database has the same purpose as the operator that delivers the data. If the receiver of the data is a foreign data bank, the delivery without authorisation must be done with a written record and due verification that the laws of the recipient of the information offer guarantees for the protection of the rights of the data subject.