The country has two main instruments regulating data protection: Law No. 1,581 and Decree No. 1,377. Law No. 1,581 establishes the guiding principles of data protection (such as finality, transparency, and confidentiality). Decree No. 1,377 complements and modifies Law No. 1,581. In addition, Law No. 1,266 developed the habeas data, particularly regarding financial, credit, commercial, services, and information from third countries.

Pursuant to Art. 4 of Decree No. 1,704, telecommunications providers must keep and store for a period of five years subscribers' personal information, such as identity, billing address, and connection type. This information must be available to the Attorney General or any competent authority in the context of a criminal investigation.

According to Art. 23 of Decree 1,377, controllers and processors should appoint a person or function within the company that assumes responsibility for the protection of personal data, tasked with reviewing and solving claims made by data subjects. Furthermore, Title VI of Law No. 1,581 establishes the duties of those responsible for data treatment and in charge of data treatment.

Art. 44 of Statutory Law No. 1621 stipulates that telecommunications service operators are obliged, upon request and within the framework of an authorised operation and insofar as technically feasible, to provide intelligence and counterintelligence bodies with the communication histories of the relevant telephone subscribers, the technical identification data of the subscribers under scrutiny, the location of the cells in which their terminals are situated, and any other information that may assist in determining their whereabouts. These bodies must ensure the security of the information received and, for that purpose, must limit their requests to data covering a period not exceeding five years, with such requests to be submitted in writing by the Directors of the intelligence bodies or their duly appointed delegates. Art. 3 establishes that intelligence and counterintelligence functions are undertaken by designated units of the Armed Forces and the National Police, the Financial Information and Analysis Unit (UIAF), and any other bodies empowered by law. Despite the safeguards found in Art. 4, 5, and 15, these requests do not require a court order or warrant.

A basic legal framework on intermediary liability for copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

Colombia has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Decree No. 1,630 creates a national registry of mobile phones through the adoption of two databases. The negative database contains the IMEI (International Mobile Equipment Identity) of the devices that have been reported as stolen or lost, both in Colombia and abroad, while the positive database includes the mobile equipment imported or legally manufactured in Colombian territory. The latter connects the IMEI with the identity of the user, who is required to provide the telecommunication operators (or mobile telecommunications networks and services providers) with their full name, type and identity document number, address and telephone number. Although there is no mandatory registration of SIM cards, the IMEIs are associated with a specific user. Art. 5 of Decree No. 1,630 states that telecommunications providers must bear the costs of the system that supports the positive and negative databases, which must be managed by an independent legal entity and should guarantee the quality of the service. More regulation on the databases is contained in Resolution No. 3,128.

Laws No. 256, Andean Community Decision No. 486, and the Penal Code collectively constitute Colombia’s core framework for the protection of trade secrets. Arts. 260–266 of Decision No. 486 provide the principal substantive definition of "secreto empresarial", grounding protection in three cumulative elements: the information must be secret, possess commercial value by virtue of its secrecy, and be subject to reasonable measures designed to preserve its confidentiality. These provisions clarify that protectable trade secrets may relate to, inter alia, products, production processes, and methods of distribution or service delivery. They also prohibit the unauthorised acquisition, use, or disclosure of protected information in a manner contrary to honest commercial practices, characterising misappropriation as a form of unfair competition.
In addition, Art. 16 of Law No. 256 punishes the violation of trade secrets and Art. 308 of the Penal Code defines the violation of trade secrets and establishes a sanction.

According to Resolution No. 912, telecom subscribers must provide telecom concessionaires with their name, address, contact number and ID number. The police duplicate this database. Telecommunications service providers authorised to operate must “allow remote queries” to subscriber’s data “via the web through VPN”, which must contain the following information: complete names or registered corporate or trade name; identification number and type or tax identification (for legal entities); address; telephone number; city of residence; mobile number or fixed line number; “ID and FLOTA number” if any; activation date. In case of changes, telecommunications service providers must send updates to DIJIN ("Dirección de Investigación Criminal e INTERPOL de la Policía Nacional") every month (Art. 1 and Annex I).

Resolution CRC No. 7120 of 2023 replaced Chapter 10 of Title IV of Resolution CRC No. 5050 of 2016 with a unified regulatory framework governing access to eligible infrastructure for the deployment of telecommunications networks and services. Pursuant to Arts. 4.10.1.1–4.10.1.4, the framework covers telecommunications poles and canalisation systems, including ducts, chambers and inspection boxes, as well as eligible infrastructure in the electricity, mass-transport, road and urban-furniture sectors. Infrastructure providers are required to grant access and permit shared use subject to the applicable requirements concerning efficiency, non-discrimination, technical feasibility and remuneration. Art. 6 of Resolution CRC No. 7120 repealed the former Chapter 11 of Title IV and Resolution CRT No. 2014 of 2008, whose subject matter was incorporated into the new unified Chapter 10.

The government of Colombia holds 32.5% shares of Colombia Telecomunicaciones SA (COLTEL) ESP, which operates under the brand Movistar and focuses mainly on the telephony and mobile connection businesses. In September 2018, the authorities reported that the State was going to sell its stake in the company, but this has not been the case yet. Some public telecommunication companies exist at the local level, as ETB (which provides services in Bogotá), EPM (in Medellín), and Metrotel (in Barranquilla).

The country does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there has been an obligation to separate accounting since 1997. Under Art. 2.9.1.2 of Resolution CRT No. 87 of 1997, vertically integrated public switched telephone network operators had to maintain separate accounts for long-distance services and for local, extended-local and rural mobile telephone services. The accounts had to distinguish the assets, liabilities, revenues, costs and expenses attributable to the respective services.
In addition, according to Arts. 9.1.2.1. and 9.1.2.2. of Resolution 5050 of 2016 (as amended by Art. 1 of Resolution No. 5589 of 2019), Telecommunications Network and Service Providers and/or Pay TV Operators are obliged to adopt separate accounting schemes in compliance with Art. 22 (numeral 19) and Art. 64 (numeral 8) of Law No. 1,341 of 2009.

Colombia has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Pursuant to Law No. 816, public administration entities that, under the applicable contracting regime, must select contractors through tenders, calls for bids, or public competitions are required to apply objective evaluation criteria that favour domestic industry. Art. 2 provides that bids offering goods and services of Colombian origin benefit from a margin of preference of 10% to 20%, while bids offering foreign goods and services that incorporate inputs of Colombian origin benefit from a margin of preference of 5% to 15%. The concept of “origin” for services was amended by Decree No. 680 of 2021 to encompass the domestic goods and labour required to supply those services.