The main current players in the Colombian telecommunications market are:

• Claro (Comunicacion Celular S.A. Comcel S.A.): provides mobile, fixed broadband, fixed and mobile telephony, and Pay TV services.
• Movistar (Telefónica Colombia) – provides mobile, fixed broadband, fixed and mobile telephony, and Pay TV services.
• Movistar (Telefónica Colombia) and Tigo (Millicom): provide mobile, fixed broadband, fixed and mobile telephony, and Pay TV services.
• WOM (Partners Group): focuses mainly on mobile services and has become a key competitor in the mobile market since its entry.
• ETB (Empresa de Telecomunicaciones de Bogotá): provides fixed broadband, mobile, and Pay TV services, mainly in Bogotá.
• DIRECTV (Vrio Corp.): provides satellite Pay TV and fixed wireless broadband services.
• OnNet Fibra Colombia (joint venture between Telefónica and KKR): operates as a wholesale neutral fiber network provider, supporting broadband deployment across the country and carrier services.

According to the Boletín Trimestral de las TIC – First Quarter 2025 published by Colombia’s Ministry of Information and Communication Technologies ("MinICT"), mobile services continue to dominate the telecommunications market in terms of penetration and coverage. As of March 2025, the country registered 92.5 million active mobile lines, equivalent to a penetration rate of 173.8 lines per 100 inhabitants. Claro remains the leading mobile operator with 41.2 million lines, followed by Movistar with 21.0 million, Tigo with 16.8 million, and WOM with 7.4 million. In terms of network coverage, 4G technology is available in 100% of municipalities, while 5G coverage reaches 2.46%, and older technologies such as 3G (HSPA+) and 2G remain almost universally available.

Mobile internet access also shows a high level of penetration. By the end of the first quarter of 2025, there were 49.1 million mobile internet connections, representing 92.2 accesses per 100 inhabitants. Most of these connections are provided through 4G technology (40.7 million), while 5G connections reached 4.7 million, and 3G connections accounted for 3.5 million. Claro leads this segment with 27.8 million accesses, followed by Tigo (8.6 million), Movistar (8.5 million), and WOM (3.1 million). Regarding access modalities, 27.4 million correspond to on-demand connections (51.5 per 100 inhabitants), and 21.7 million correspond to subscription-based connections (41 per 100 inhabitants), showing a growing preference for subscription plans and 5G adoption.

Fixed broadband continues to expand gradually, supported mainly by fiber deployment. As of the first quarter of 2025, Colombia recorded 9.34 million fixed internet accesses, equivalent to 18 per 100 inhabitants. The leading technologies are fiber optic, with 4.9 million accesses (a quarterly increase of 7%), and cable, with 4.0 million accesses (a decrease of 1.1%). xDSL and other technologies such as WiMAX, WiFi, and satellite represent a small fraction of the market, with around 400,000 accesses combined. The average national download speed reached 236 Mbps, and the main providers in this segment are Comcel (3.28 million accesses), UNE EPM (1.70 million), Movistar (1.58 million), and ETB (0.57 million).

In contrast, fixed telephones continue to decline. The report indicates that Colombia had 6.11 million fixed lines by March 2025, corresponding to 11 lines per 100 inhabitants, with a quarterly variation of –3.2%. Comcel leads this segment with 3.1 million lines, followed by Movistar (1.1 million), UNE–EPM (1.03 million), and ETB (0.5 million). Finally, it is important to note that the report does not include data on Pay TV services for this period.

Colombia is advancing in ICT development, but still faces structural and regional challenges. After the 2023 5G spectrum auction, operators such as Claro, Movistar, and Tigo began deployment of the appropriate infrastructure. By late 2024, about 1,400 5G base stations were active in 43 cities (≈ 5% of all mobile sites), with Bogotá leading coverage. 4G remains dominant, except in rural regions.

IoT adoption is increasing in agriculture and environmental monitoring, supported by government programs like Conectar la Ruralidad 2026 and the CEA-IoT innovation center. Market consolidation continues, with Telefónica selling part of its Colombian business to Millicom.

The main laws governing telecommunications in Colombia are Law 1341 of 2009 and Law 1978 of 2019, which together form the General Telecommunications Legal Framework ("GTLF"). This framework establishes the principles for the provision of telecommunications networks and services, the use of the radio spectrum, and the organization of the institutional structure of the sector. Law 1341 of 2009 defines telecommunications as a public service under State control, generally open to private participation through registration in the ICT Registry administered by the MinICT. Law 1978 of 2019 modernized the sector by promoting investment, encouraging infrastructure deployment, and strengthening the regulatory framework.

In addition, Law 2294 of 2023 introduced provisions allowing telecommunications networks and services providers (TNSPs) to offset up to 90% of their regulatory spectrum fees through rural connectivity projects, reinforcing the State’s universal access policy.

With respect to satellite services, the key regulations are Resolution 376 of 2022 (which replaced Resolutions 106 of 2013 and 290 of 2010). This resolution sets forth the requirements and procedures for obtaining radio spectrum permits for earth stations associated with fixed-satellite, mobile-satellite, and broadcasting-satellite services, and establishes a new regulatory fee framework.

Regulatory authorities:

• The MinICT is the lead authority responsible for ICT policy, sector oversight, and management of the ICT Registry.
• The National Spectrum Agency ("ANE") manages and monitors the use and allocation of the radio spectrum.
• The Communications Regulatory Commission ("CRC") acts as an independent regulatory body that promotes competition, ensures service quality, prevents anti-competitive practices, and regulates network access and interconnection conditions.

The GTFL provides a general authorization regime for the provision of telecommunications services. The GTFL establishes that the provision of telecommunications networks and services—a public service under the control and supervision of the State—is generally permitted to private entities, provided that TNSPs and companies using radio spectrum frequencies are duly registered before the MinICT in the ICT Registry.

The ICT Registry authorizes TNSPs to provide telecommunications networks and services within Colombian territory, as well as to install, modify, operate, and exploit telecommunications networks. However, it does not grant authorization to use the radio spectrum, which requires a separate and express permit issued by the MinICT through a public bidding process.

Spectrum authorizations can be granted for 20 years and may be renewed for an additional 20-year term, thereby promoting long-term investment in the sector. The allocation criteria prioritize proposals that include rural internet coverage, ensuring that spectrum use contributes to the reduction of the digital divide.

Spectrum use fees are determined based on factors such as the amount of spectrum assigned, the number of potential users, and network expansion plans. These payments are made to the Fund for Information and Communication Technologies (ICT Fund). Pursuant to Law 2294 of 2023, TNSPs may choose to pay up to 90% of their regulatory fees in kind through rural connectivity projects, thus supporting the government’s universal access and digital inclusion policies.

In relation to satellite communications, until February 2022, the applicable framework was mainly defined by Resolutions 106 of 2013 and 290 of 2010 issued by the MinICT.

• Resolution 106 of 2013 established the general framework for the provision and use of satellite capacity in Colombia, including the requirements for registration in the Satellite Capacity Registry, which is mandatory for entities that offer, provide, or use satellite capacity for themselves or third parties, in accordance with International Telecommunication Union ("ITU") procedures.
• Resolution 290 of 2010 set forth the regulatory fee structure for the use of the radio spectrum associated with the satellite segment, including the formula for calculating payments based on the bandwidth used.

Subsequently, Resolution 376 of 2022 repealed Resolution 106 and amended certain provisions of Resolution 290. The new resolution introduced updated requirements and procedures for obtaining radio spectrum permits for earth stations associated with fixed-satellite, mobile-satellite, and broadcasting-satellite services, and defined a new regulatory fee framework for spectrum use by both geostationary and non-geostationary satellite systems.

The MinICT and the ANE are jointly responsible for the management, allocation, and supervision of the radio spectrum in accordance with the National Frequency Band Allocation Chart, ensuring compliance with technical, financial, national security, and environmental sustainability requirements, as well as the timely payment of spectrum-related fees by TNSPs.

On the other hand, subscription broadcast television and radio services require a concession obtained via a public bidding process.

There are no general restrictions on foreign ownership in Colombian telecom companies under the general authorization regime. Foreign companies must establish a local branch or subsidiary, register with the Colombian Company registry, and meet tax and corporate requirements to obtain an ICT Registry.

Service prices in Colombia are currently freely determined by providers.

TNSPs have the obligation to update, clarify or correct the information contained in the RTIC, within 15 business days following the date of change of information, or when the MinICT requires it. Among the information that must be updated is the change in control situations of the registered provider (article 2.2.1.3.1. National Decree 1078 of 2015). Failure to comply with this obligation constitutes an infringement of the legal regime of the telecommunications sector, subject to: (i) reprimand; (ii) fine of up to 15,000 current monthly legal minimum wages; (iii) suspension of the operation to the public for up to 2 months; (iv) revocation of the contract; or (v) cancellation of the license, authorization or permit. In any case, this is an information obligation without suspensive effects.

Under Decree 1078 of 2015, the holders of radio spectrum use permits may transfer such permits to another entity only with prior authorization from the MinICT. To obtain this authorization, both the assignor and assignee must meet several legal and technical conditions. In any case, it is advisable to assess the respective license in order to identify any restrictions on its transfer.

Yes. Colombia has universal service obligations defined under Law 1341 of 2009, as amended by Law 1978 of 2019 and further developed by Law 2108 of 2021.

The concept of universal service was first formally introduced through Resolution 1272 of 2020. According to this resolution, universal service means the availability of a minimum set of ICT services that are economically affordable for all users nationwide.

Building upon this framework, Law 2108 of 2021 declared Internet access an essential public service, ensuring its continuous, efficient, and permanent provision throughout the national territory. The law guarantees universal connectivity, especially for vulnerable populations and rural or remote communities.

The GTFL imposes mandatory interconnection and access obligations. Telecom and ICT service providers must allow interconnection of their networks and ensure non-discriminatory access to essential facilities such as ducts, towers, and other infrastructure. Agreements must be transparent and notified to the regulator, MinICT.

Colombia enforces net neutrality under Resolution 3502 of 2011 issued by the CRC. Internet Service Providers ("ISPs") must treat all lawful Internet content, applications, and services equally, without blocking, restricting, or discriminating against any of them.

ISPs must allow the use of any legal devices, provide parental control options, ensure transparency on service quality and speed, protect user privacy and network security, and may only block content at the explicit request of the user or illegal content such as child pornography. 

The radio spectrum is a scarce public resource managed exclusively by the Colombian Government. To provide ICT services, operators must hold an ICT Registry and obtain frequency authorization from MinICT.

In Colombia, high-demand mobile frequencies such as 5G or IMT bands are awarded through a public auction process regulated by the MinICT, as established in Resolution 3947 of 2023. The process begins with a public consultation period, followed by the publication of final auction terms and conditions. Interested operators must meet eligibility requirements related to technical capacity, regulatory compliance, and financial standing.

Spectrum is then allocated to the highest bidders, subject to coverage and deployment obligations, particularly in rural or underserved areas. The awarded spectrum permits are valid for 20 years, renewable for an additional 20, and include specific technical and service quality commitments.

Telecom infrastructure in Colombia (including fiber networks, antennas, and towers) requires permits at both the national and local levels. The MinICT regulates spectrum use and overall licensing, while municipal and regional authorities issue authorizations for civil works, land use, and rights of way. Although local governments retain regulatory authority, they must not impose conditions that hinder the deployment of ICT services. In 2024, new regulations were issued to standardize and streamline the permitting process across municipalities, seeking to unify the technical and procedural requirements for obtaining local permits, though each municipality continues to apply and enforce them within its jurisdiction.

In Colombia, the deployment and sharing of passive telecom infrastructure—such as poles, ducts, towers, and other physical supports—is governed by Chapter 10 of CRC Resolution 5050 of 2016, as amended by Resolution 7120 of 2023. This framework sets the conditions for access, use, and remuneration of telecom and other sector infrastructures classified as “eligible” for shared use.

The regulation applies to both telecommunications networks and service providers and to any public or private entity that owns, controls, or manages eligible infrastructure. It establishes that these infrastructures must be made available under fair, transparent, and non-discriminatory conditions to facilitate network deployment and service provision. Additionally, the regime must be implemented in compliance with urban planning and environmental regulations.

For the deployment of infrastructure, in 2024, new regulations were issued to standardize and streamline the permitting process across municipalities, seeking to unify the technical and procedural requirements for obtaining local permits, though each municipality continues to apply and enforce them within its jurisdiction.

For the operation of a submarine cable in Colombia, it is necessary to be registered in the ICT Registry administered by the MinICT, which authorizes entities to operate telecommunications networks and services in the country. Additionally, the project requires obtaining permits for civil work and construction, as well as environmental and maritime authorizations, depending on the specific location of the landing point. Each municipality or local authority may impose additional requirements related to land use, coastal management, and environmental protection, which must also be duly fulfilled.

In Colombia, the use of radio spectrum for satellite communications is regulated by the MinICT under Resolution 376 of 2022, as amended by Resolution 4015 of 2023.

This framework applies to all natural or legal entities that require the use of radio spectrum associated with satellite radiocommunication services through earth stations that communicate with geostationary or non-geostationary satellites.

Operating earth stations with uplink transmissions (Earth-to-Space) must obtain a spectrum use permit from MinICT. Conversely, receive-only stations (Space-to-Earth) do not require a spectrum permit, unless the operator requests to include the station in spectrum management processes handled by MinICT or the ANE—for instance, to address interference coordination or coexistence with International Mobile Telecommunications ("IMT") services.

Each permit specifies the technical characteristics and location of the earth stations, ensuring compliance with the National Frequency Allocation Table ("CNABF") and the International Telecommunication Union ("ITU") regulations.

Yes. Spectrum use permits issued by MinICT include a detailed description of the earth stations associated with satellite service, as well as their technical operating conditions.

Not yet fully regulated.

Yes. In Colombia, telecommunications devices—specifically Mobile Terminal Equipment —are subject to a mandatory homologation (type approval) process regulated by the CRC under Resolution 6129 of 2020, which replaced earlier rules in Resolution 5050 of 2016.

Once approved, the CRC registers the device in the official database of homologated equipment, which is publicly available and must be consulted by telecom providers before activating any device on their networks. Fixed and satellite phones are not subject to homologation but must comply with technical standards established by the CRC.

Colombia’s audiovisual market is experiencing steady growth, particularly in streaming/OTT services, while traditional broadcasting remains significant but under pressure from digital change. Many households still subscribe to pay TV, but there is increasing cord-cutting, especially among younger demographics. The use of OTT platforms (both paid and free) is growing.

Main players include large free-to-air networks such as RCN, Caracol, as well as public service channels like RTVC. For pay TV, providers like Claro, DirecTV, local cable and satellite operators. There are also global OTT platforms like Netflix, Amazon Prime, Disney+, along with local/ regional streaming services such as Ditu.

Regulatory issues include governmental pressure to define regulatory obligations for OTT/streaming platforms, such as the renowned “fair share”. There are also industry initiatives championed by trade associations to protect copyrights against wrongdoers recognized as pay TV operators. Additionally, collective management organizations are bringing claims against OTT/streaming platforms for “equitable remuneration” rights recognized in the “Pepe Sánchez” Law and the “Fanny Mikey” Law.

The main laws are:

• Key laws include Law 182 of 1995 (Regulates Television Service and Policies for Its Development) and Law 680 of 2001 (which amends Laws 14 of 1991, 182 of 1995, and 335 of 1996, among others) as the principal legal bases for television/concessions regulation. Law 1978 of 2019 amended Law 1341 of 2009 to restructure the sector and reinforced the CRC and the MinICT as the regulators for television matters. 
• For incentives and production, Law 814 of 2003 established the “Film Law” to promote national production in Colombia. Law 1556 of 2012 also provides for the Colombia Film Fund ("FFC") and the Audiovisual Investment Certificates ("CINA") to promote foreign audiovisual production in Colombia. 
• There are also regulatory resolutions, particularly Resolution CRC 5050 of 2016 (on television service operation, programming, advertising, etc.).
  Authorities:
• MinICT is the lead authority responsible for ICT policy, which includes television services.
• ANE manages and monitors the use and allocation of the radio spectrum.
• CRC acts as an independent regulatory body that promotes competition, ensures service quality, prevents anti-competitive practices, and regulates operational conditions for television services.
• The Ministry of Culture plays a role in incentives and in matters related to the audiovisual production sector.

Please see our comments to Question 5 on the ICT Registry for free-to-air and pay TV television operators established since the enactment of Law 1978 of 2019. The previous regime consisted of the obtention of concessions for each kind of television service with specific technical, financial, and legal requirements.
Whenever television operators use radioelectric spectrum, a spectrum authorization is warranted in the same terms set forth in our comments to Question 11.

Yes. Please see our comments to question 8.

Yes. Foreign investment restrictions in the audiovisual sector in Colombia mainly apply to companies seeking to qualify as Colombian film production companies for the purpose of accessing tax and financial incentives established under Law 814 of 2003 ("Film Law").

A Colombian film company must have at least 51% of its subscribed and paid-in capital owned by Colombian nationals, and its corporate purpose must involve film production. Similarly, a Colombian film production (for feature films) must be financed with at least 51% Colombian capital to be recognized as a national production. This recognition is required to access public incentives and funds such as the Film Development Fund ("FDC") administered by the Ministry of Culture. 

No. The ICT Registry may include different services depending on the business model of the TNSPs (e.g., television operators).

Yes. The Ministry of Culture, through its Film Directorate (Dirección de Cinematografía), manages the Cinematographic Information and Registration System (SIREC for its acronym in Spanish), which is the official registry for entities and individuals involved in film and audiovisual activities.

Registration is mandatory for feature film producers, distributors, and exhibitors, and voluntary for other sector participants. Registrants must provide detailed information in the official form issued by the Film Directorate, signed by the individual or legal representative, and accompanied by supporting documents.

Advertising agencies are not required to register under SIREC, but if they produce audiovisual works for film or television, they may also register as producers or service companies, depending on their activities.

Yes. Free-to-air television operators and pay TV operators must periodically report their programming using the official CRC reporting format. This report must be submitted quarterly, within 10 business days after the end of each quarter.

The report covers the origin of the content (national or foreign) and not original vs. acquired content.

Yes. Colombian regulation requires broadcasters to classify and report their programming according to audience suitability and content genre. Each program must be categorized by:

• Audience classification: Children (Infantil), Teen (Adolescente), Family (Familiar), or Adult (Adulto).
• Content genre: Fiction, Non-fiction, News/Informative, Children’s, Sports or Musical.

This classification must be reflected in the quarterly content reports submitted to the CRC indicated in our comments to question 26.

Yes. Free-to-air television operators must comply with the following minimum quotas of national programming each quarter:

• From 19:00 to 22:30 (prime time): at least 70% of programming must be national.
• From 22:30 to 24:00: at least 50% national production.
• From 10:00 to 19:00: at least 50% national production.
• On Saturdays, Sundays, and holidays, the national content during prime time must be at least 50%.
• For regional and local broadcasters, at least 50% of total programming must be national.

Pay TV operators are also required to include at least 5 thematic national channels in their programming lineup, unless they operate an in-house production channel that broadcasts a minimum of five hours of original national programming per day.

Yes. There remain must-carry type obligations (public interest channels and national public service channels) that pay TV operators must carry, though the precise scope and channel list is governed by CRC rules and specific resolutions.

Colombian audiovisual regulation does not impose local production requirements for advertising, whether domestic or foreign. However, free-to-air television operators must comply with content and time-slot restrictions established by the CRC.

Yes. The CRC Resolution 7423 of 2024 establishes detailed restrictions by audience segment (franja de audiencia) and by product category, particularly protecting children and adolescents. There are specific prohibitions on alcohol and tobacco advertising.

No. There is no specific registry for advertisers in Colombia, nor any reciprocity requirement for foreign advertisers.

Yes. The audiovisual sector benefits from dedicated production incentives (cash rebates / transferable tax credits). There are also special VAT rules that benefit the audiovisual industry by exempting them from paying it under a figure named “export of services”.

There are no obligations for OTTs to register locally or appoint a legal representative.

Accordingly, there is no rule on local content quotas or prominence of local content for OTT SVOD. However, Article 154 of Law 1955 of 2019 establishes that SVOD services provided via OTT platforms must add an easily available section for Colombian users that includes audiovisual works produced in Colombia. According to this same Article 154, the Colombian Government has to regulate the implementation of this obligation within 12 months following the enactment of Law 1955 (May 25, 2019), considering international treaties signed by Colombia.

There has been discussion of whether or not this refers to a content quotas obligation, or if the obligation is met simply by having a section where Colombian users can find audiovisual works produced in Colombia, if any. There will only be certainty as to the extent and nature of the obligation until the aforementioned regulation is passed.

Digital/streaming platforms are now subject to direct and indirect tax rules under Colombia’s recent tax reforms (Significant Economic Presence/SEP), which have been subject to regulation by Colombian tax authorities.

Colombia does not have a comprehensive AI Act. Key instruments include: (i) the 2025 National AI Policy (CONPES 4144); (ii) the 2019 Digital Transformation and AI Policy (CONPES 3975); and (iii) the Superintendency of Industry and Commerce’s (the “SIC”) binding guidance for AI-driven personal data processing (External Circular 002 of 2024).

There are sector regulators’ rules that affect AI deployments, such as in finance (Superintendency of Finance of Colombia (the “SFC”) External Circular 007 of 2018 on cybersecurity and information-security), telecoms (CRC Resolution 5569 of 2018 on information security management system), and health (Law 2015 of 2020 on electronic health-record interoperability and safeguards, as well as Resolution 866 of 2021).

The MinICT (policy and national digital strategy), the National Planning Department (CONPES coordination), the SIC (data protection and consumer protection, including AI transparency), and sector regulators/superintendencies (e.g., the SFC for finance and the CRC for telecoms).

Bill 043 of 2025, currently before Congress, seeks to establish a comprehensive legal framework for the governance and oversight of AI systems.

There is no general legal framework applicable to AI-based services. Each service must be assessed on a case-by-case basis under Colombia’s data protection, consumer and sectoral rules.

Colombia has not adopted an EU‑style list of ‘prohibited’ or ‘high‑risk’ AI practices. However, the SIC has provided guidance with respect to guardrails that may restrict certain uses. For example, processing sensitive data demands an explicit legal basis and reinforced safeguards, and discriminatory automated decisions are unlawful. 

Colombia promotes principles like accountability, human oversight, transparency, risk-based governance, privacy and security by design, and bias mitigation as set out in CONPES 4144 of 2025 and SIC External Circular 002 of 2024.

There is no standalone law, but controllers must ensure explainability and keep documentation that demonstrates compliance under the accountability principle in Law 1581 of 2012 and its related decrees, as interpreted by the SIC in various decisions. 

Controllers must inform users about automated decision-making, its purposes, data categories, and potential impacts, and provide channels to exercise their data rights.

They are not legally required, but the SIC recommends data protection impact assessments, especially for high-impact processing like profiling or sensitive data use.

Please refer to the answers provided to questions 35 and 36 above.

Colombia’s framework combines public‑policy instruments and binding general and sectoral rules. This framework includes the National Policy on Digital Trust and Security (CONPES 3995 of 2020), the National Digital Security Strategy 2025–2027, among others. There are sector‑specific minimums: for telecoms, the CRC Resolution 5569 of 2018; for finance, the SFC External Circular 007 of 2018; for health, Law 2015 of 2020 and Resolution 866 of 2021; and personal‑data security duties under the Colombian General Data Protection Regime ("CGDP"), enclosed in Law 1581 of 2012 and Decree 1074 of 2015.

Yes. Colombia has an in-force National Digital Security Strategy 2025–2027, launched by the MinICT in June 2025, which sets objectives on governance, resilience, and incident response, among others.

Please refer to question 38.

Yes, the SIC has sanctioned various entities in cases related to cybersecurity incidents. For example, by means of Resolution 55943 of 2021, the SIC sanctioned Cooperativa Autónoma de Seguridad for failing to report security breaches. In Resolution 71406 of 2023, the SIC investigated a data scraping incident involving LinkedIn, where third parties unlawfully accessed user information, and ordered the company to strengthen its security measures, implement an incident response program, and improve its monitoring and reporting procedures.

The CGDP establishes data breach notification obligations, applicable to both data controllers (i.e., the entities that decide about databases and the processing of personal data contained therein) and data processors (i.e., entities that process personal data on behalf of data controllers). According to the CGDP, data controllers and data processors are required to notify the SIC about incidents that involve the violation of security codes or risks to the management of personal data that can affect the confidentiality, availability, and integrity of personal data of Colombian residents. There is no statutory threshold for notification obligations to be triggered, in terms of the number of affected individuals, the type of data or the likelihood of risk.

In Colombia, coordination between companies and authorities during a cyberattack is governed by both legal obligations and institutional protocols. The primary authority responsible for cybersecurity coordination is the Colombian Emergency Response Team ("COLCERT"), which operates under the MinICT. COLCERT is tasked with managing national-level cybersecurity incidents, including coordinating responses between public and private entities.

Cybercrimes are specifically criminalized under Law 1273 of 2009 (Penal Code, articles 269A to 269J), which covers conduct such as unauthorized access, data interception, system obstruction, malware use, data theft, phishing, and computer fraud. These provisions provide the basis for prosecuting attackers and protecting affected entities.

Colombia has been party to the Budapest Convention on Cybercrime since 2020, which establishes legal and procedural tools for cross-border cooperation and evidence exchange. In 2022, Colombia also signed the Second Additional Protocol on Enhanced Cooperation and Electronic Evidence. Colombia is a party to the Inter-American Convention on Mutual Assistance in Criminal Matters ("OAS") and the UN Convention against Transnational Organized Crime ("Palermo Convention").

Relatedly, Colombia participates in regional and international networks such as CSIRTAmericas and is a member of the Global Forum on Cyber Expertise ("GFCE"), where it engages in working groups on incident management, culture, and policy.