It is reported that Decree No. 2025/2015 creates burdensome restrictions and administrative requirements for trade in mobile phones. The Decree establishes measures to control the import and export of intelligent mobile phones, cellular mobile phones, and their parts, susceptible to classification under Customs Tariff subheading 8517.12.00.00 and 8517.70.00.00, as part of its strategy to address the theft of mobile phones.
In particular, the decree mandates that each mobile phone have a government-issued International Mobile Equipment Identity (IMEI) verification certificate at the time of import and requires all importers and exporters to pre-register with the National Police in order to trade in mobile phones.
Chapter I of Decree No. 2025 establishes the import conditions of mobile phones. According to Art. 3, mobile phones whose IMEI is registered in the databases referred to in Art. 106 of No. Law 1,453 of 2011 may not be imported. But, importation is permitted if: (a) it is an IMEI reported in the positive database, (ii) in the case of import in compliance with a guarantee or (iii) the re-import of previously exported phones. Also, intelligent mobiles can be imported if the travellers carry them when entering the national territory as a personal possession (and no more than three units). Importation is also allowed under the modality of postal traffic and urgent shipments if it is just one mobile/intelligent phone that fulfils customs regulations."
Art. 1 of Decree No. 2,142 amended Art. 3 of Decree No. 2025/2015 (Chapter I), yet the conditions for importing mobile phones remain largely unchanged. While these restrictions predate the amendment, Decree No. 2,142 introduced a more lenient regime allowing the import under the modality of postal traffic and urgent shipments if it is just one mobile/intelligent phone that fulfils customs regulations.

It is reported that slow customs-clearance procedures in Colombia hamper both import and export activities. Earlier reports also identified significant delays in implementing customs reforms that would allow traders to submit electronic copies of invoices instead of physical documents. Those reforms were originally scheduled for implementation under Decree No. 390 of 2016 and were subsequently postponed by Decree No. 349 of 2018. More recent reports indicate that the electronic-document system had still not been implemented by 2025 and that the relevant digital customs system remained under development.

According to Art. 7 of Decree No. 2025/2015, the export of smartphones/mobile phones is prohibited, with some exceptions:
- Export is allowed if travellers carry the phones when leaving the national territory as personal possession (and no more than three units);
- In the case of temporary export;
- In case of definitive export, when they are considered waste electrical or electronic equipment;
- When the export of smartphones or mobile phones originates from a free zone within Colombia, and the products have been transformed, assembled, stored, repaired, or serviced by users of the free zone.
In addition, Art. 4 of Decree No. 2,142 modified Art. 7 of Decree No. 2,025 (chapter II), but export conditions for mobile phones remain in place.

It is reported that the Communications Regulation Commission (CRC, Comisión de Regulación de Comunicaciones), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process. Law No. 1,978 of 2019 significantly strengthened this independence. Under Art. 15, which amended Art. 19 of Law No. 1,341 of 2009, the CRC has its own legal personality and enjoys administrative, technical, patrimonial, and budgetary autonomy, without being subject to hierarchical or tutelary control.

Art. 5 of Law No. 1,266 establishes that a personal data transfer between data bank operators is permitted when authorisation is obtained from the data subject or when the destination database has the same purpose as the operator that delivers the data. If the receiver of the data is a foreign data bank, the delivery without authorisation must be done with a written record and due verification that the laws of the recipient of the information offer guarantees for the protection of the rights of the data subject.

According to Art. 26 of Law No. 1,581, cross-border transfer of personal data is forbidden unless it is made to a country that offers adequate levels of data protection, as defined by the Colombian data protection authority. The prohibition does not apply in certain cases, including when the data subject authorises the cross-border transfer or when medical data is required for health or public hygiene reasons. According to the law, the institution in charge, "Superintendencia de Industria y Comercio" (SIC), establishes the standards regarding international data transfers.
Pursuant to Section 3.2 of External Circular No. 005/2017, as amended by External Circular No. 002/2018, the jurisdictions recognised as providing an adequate level of data protection include EU Member States, as well as Australia, Costa Rica, Japan, Iceland, Norway, Peru, Serbia, the Republic of Korea, the United Kingdom, and the United States.

According to Art. 13.11 of the First Amending Protocol, which amends the Additional Protocol to the Framework Agreement of the Pacific Alliance, the four parties (Chile, Colombia, Peru and Mexico) commit to allowing cross-border information transfers through electronic means, including also the transfer of personal data for business activities. Moreover, in Art. 13.11 bis, the parties commit to ban forced localisation of computer facilities in their national territories.

The country has two main instruments regulating data protection: Law No. 1,581 and Decree No. 1,377. Law No. 1,581 establishes the guiding principles of data protection (such as finality, transparency, and confidentiality). Decree No. 1,377 complements and modifies Law No. 1,581. In addition, Law No. 1,266 developed the habeas data, particularly regarding financial, credit, commercial, services, and information from third countries.

Pursuant to Art. 4 of Decree No. 1,704, telecommunications providers must keep and store for a period of five years subscribers' personal information, such as identity, billing address, and connection type. This information must be available to the Attorney General or any competent authority in the context of a criminal investigation.

According to Art. 23 of Decree 1,377, controllers and processors should appoint a person or function within the company that assumes responsibility for the protection of personal data, tasked with reviewing and solving claims made by data subjects. Furthermore, Title VI of Law No. 1,581 establishes the duties of those responsible for data treatment and in charge of data treatment.

Art. 44 of Statutory Law No. 1621 stipulates that telecommunications service operators are obliged, upon request and within the framework of an authorised operation and insofar as technically feasible, to provide intelligence and counterintelligence bodies with the communication histories of the relevant telephone subscribers, the technical identification data of the subscribers under scrutiny, the location of the cells in which their terminals are situated, and any other information that may assist in determining their whereabouts. These bodies must ensure the security of the information received and, for that purpose, must limit their requests to data covering a period not exceeding five years, with such requests to be submitted in writing by the Directors of the intelligence bodies or their duly appointed delegates. Art. 3 establishes that intelligence and counterintelligence functions are undertaken by designated units of the Armed Forces and the National Police, the Financial Information and Analysis Unit (UIAF), and any other bodies empowered by law. Despite the safeguards found in Art. 4, 5, and 15, these requests do not require a court order or warrant.

A basic legal framework on intermediary liability for copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

Colombia has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Decree No. 1,630 creates a national registry of mobile phones through the adoption of two databases. The negative database contains the IMEI (International Mobile Equipment Identity) of the devices that have been reported as stolen or lost, both in Colombia and abroad, while the positive database includes the mobile equipment imported or legally manufactured in Colombian territory. The latter connects the IMEI with the identity of the user, who is required to provide the telecommunication operators (or mobile telecommunications networks and services providers) with their full name, type and identity document number, address and telephone number. Although there is no mandatory registration of SIM cards, the IMEIs are associated with a specific user. Art. 5 of Decree No. 1,630 states that telecommunications providers must bear the costs of the system that supports the positive and negative databases, which must be managed by an independent legal entity and should guarantee the quality of the service. More regulation on the databases is contained in Resolution No. 3,128.