According to Art. 23 of Decree 1,377, controllers and processors should appoint a person or function within the company that assumes responsibility for the protection of personal data, tasked with reviewing and solving claims made by data subjects. Furthermore, Title VI of Law No. 1,581 establishes the duties of those responsible for data treatment and in charge of data treatment.

Art. 44 of Statutory Law No. 1621 stipulates that telecommunications service operators are obliged, upon request and within the framework of an authorised operation and insofar as technically feasible, to provide intelligence and counterintelligence bodies with the communication histories of the relevant telephone subscribers, the technical identification data of the subscribers under scrutiny, the location of the cells in which their terminals are situated, and any other information that may assist in determining their whereabouts. These bodies must ensure the security of the information received and, for that purpose, must limit their requests to data covering a period not exceeding five years, with such requests to be submitted in writing by the Directors of the intelligence bodies or their duly appointed delegates. Art. 3 establishes that intelligence and counterintelligence functions are undertaken by designated units of the Armed Forces and the National Police, the Financial Information and Analysis Unit (UIAF), and any other bodies empowered by law. Despite the safeguards found in Art. 4, 5, and 15, these requests do not require a court order or warrant.

A basic legal framework on intermediary liability for copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Colombia's law and jurisprudence. The liability regime for damages applicable to Internet intermediaries in Colombia is the same as that generally applied to any other activity, which is a regime of subjective civil liability since the law does not provide for a presumption of fault (or objective) for intermediaries.

Colombia has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Decree No. 1,630 creates a national registry of mobile phones through the adoption of two databases. The negative database contains the IMEI (International Mobile Equipment Identity) of the devices that have been reported as stolen or lost, both in Colombia and abroad, while the positive database includes the mobile equipment imported or legally manufactured in Colombian territory. The latter connects the IMEI with the identity of the user, who is required to provide the telecommunication operators (or mobile telecommunications networks and services providers) with their full name, type and identity document number, address and telephone number. Although there is no mandatory registration of SIM cards, the IMEIs are associated with a specific user. Art. 5 of Decree No. 1,630 states that telecommunications providers must bear the costs of the system that supports the positive and negative databases, which must be managed by an independent legal entity and should guarantee the quality of the service. More regulation on the databases is contained in Resolution No. 3,128.

Colombia is a signatory of the World Trade Organization (WTO) Information Technology Agreement (ITA) of 1996 and its 2015 expansion (ITA II).

Art. 20 of Law No. 80 establishes the principle of reciprocity for the participation of foreign investors in public procurement, under which foreign bidders are entitled to the same treatment that Colombian companies receive in the countries of origin of the foreign bidders.
In addition, Art. 6 of Law No. 1,150 of 2007, together with Art. 8 of Decree No. 1,510 of 2013, requires bidders established in Colombia (including foreign branches) to be enrolled in the Single Bidders Register (Registro Único de Proponentes, RUP) in order to contract with the State. As a general rule, registration in the RUP operates as a condition for participation in public procurement procedures. However, the most recent WTO Trade Review indicates that foreign firms established abroad may participate without RUP registration.
The RUP is intended to facilitate access to procurement opportunities and functions as an ex ante mechanism for verifying legal, administrative, and related eligibility requirements prior to participation in competitive tendering processes. The enrolment fee set in 2024 is COP 741,000 (approx. USD 200), which has been reported as a potential obstacle to participation in government procurement.

Art. 12.5 (Chapter III) of Law No. 590 states that micro, small and medium enterprises (MSMEs) are preferred under equal conditions (price, quality, capacity of supply, and service) in public tenders.

Art. 35 of Law No. 2069 of 2020 establishes the tie-break mechanism applicable to public procurement processes. Where two or more bids obtain the same total score, the contracting entity must apply a series of criteria sequentially and exclusively, in the order listed, while ensuring consistency with Colombia’s international commitments, until the tie is resolved. The first criterion is a preference for national goods and services over foreign goods and services. Other criteria include the preference for companies employing at least 10% of the workforce that is indigenous, Black/Afro-Colombian, Raizal, Palenquero, and Gypsy populations, and a preference for bids submitted by SMEs, cooperatives, or mutual associations.

Pursuant to Law No. 816, public administration entities that, under the applicable contracting regime, must select contractors through tenders, calls for bids, or public competitions are required to apply objective evaluation criteria that favour domestic industry. Art. 2 provides that bids offering goods and services of Colombian origin benefit from a margin of preference of 10% to 20%, while bids offering foreign goods and services that incorporate inputs of Colombian origin benefit from a margin of preference of 5% to 15%. The concept of “origin” for services was amended by Decree No. 680 of 2021 to encompass the domestic goods and labour required to supply those services.

There have been frequent complaints about the lack of transparency and rule changes during the award of major government contracts. It has been reported that, despite Law No. 80, transparency, fairness, and truly competitive bidding conditions in many tenders remain uncertain. These factors remain significant market access barriers for some companies interested in public sector contracts.

Colombia is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA). However, the country has been an observer of the WTO GPA since 1996.

According to Art. 15 of Law 9 of 1991, the general regime for the investment of foreign capital in the country and Colombian investments abroad is established by the National Government. With the exception of those matters relating to the transfer of resources abroad, foreign investment in Colombia shall be treated for all purposes in the same manner as the investment of Colombian nationals.