Short notes on questions clients actually ask

Almost every company using a foreign cloud provider, or reporting to a parent company, is already moving personal data out of Colombia. What is almost never clear is under what arrangement it does so.

The law draws a distinction between two operations that get confused in practice. One is sending the data to another company that makes decisions about it; the other is handing it to a provider that processes it on your behalf and under your instructions. They are not documented the same way.

The difference matters. In one case the basis is the data subject's authorization (autorización del titular) or a ruling from the authority; in the other, a contract with prescribed minimum content. An agreement that only promises confidentiality works for neither.

The data protection authority has published model agreements for these operations. They are useful, but voluntary, and they do not replace the authorization where one is needed. Signing them without knowing which arrangement you are using adds obligations and deadlines without settling the substance.

Before you renew with your cloud provider, define what role each party plays, check whether the document says what the data is used for and under what instructions, and set who gives notice, and within what time, if there is a breach.

The contract your company uses with its customers is almost never negotiated: it is handed over ready to sign and signed the same way every time. That makes it efficient, and the riskiest document in the business: if one clause is wrong, it is wrong in every single one.

Colombian consumer law does not wait for a judge to step in. There are clauses that, in an adhesion contract (contrato de adhesión), produce no effect: the ones that let you change the terms on your own, the ones that demand more paperwork to leave than to join, the ones that tie the customer in even when you are the one not performing.

That matters less for the fine than for the dispute. When the customer complains, the company defends itself with the contract. If that clause produces no effect, the defense disappears at the worst possible moment and what remains is the statutory rule, which is more demanding.

It is worth looking at the fine print not as a shield but as a bet: every clause that stretches the limit can fall, and take down whatever was built on top of it.

Take the contract you sign most often and read it looking for three things: how the customer can terminate it, what you can change without asking them, and what liability you are limiting. Whatever does not survive that reading, change it before a complaint does it for you.

The regulations on outsourcing have come and gone: the most recent decree is about to disappear, and others fell before it. Do not read that as an authorization. Your exposure is defined by the statute, not by the implementing decree (reglamento).

The statute describes a genuine contractor by three features: it works with its own means, it keeps technical and managerial autonomy (autonomía técnica y directiva), and it bears the risks of what it took on. If your provider does not meet all three, the commercial contract will not protect you.

Something similar happens with temporary services companies (empresas de servicios temporales, a regulated figure of Colombian labor law): the service exists for specific, temporary causes. Once the cause has lapsed and the person is still in the post, the user company (usuaria) can end up treated as the real employer.

It is worth being clear on who decides what. The labor inspector (inspector de trabajo) supervises and imposes penalties, but does not declare individual rights. Whether an employment contract existed is decided by a judge, and there the presumption runs against the employer.

Go over your own operation before someone else does it for you: who gives the instructions, whose tools are being used, who controls the working hours, how long the person who came in on a temporary cause has been in the post. Where it is uncomfortable, adjust the contract.

Almost every contract we review carries the same clause: if the counterparty becomes insolvent, the contract terminates at once and the whole debt falls due. It is the least negotiated clause of all, and the one that works worst on the day you need it.

Colombia's business insolvency regime (régimen de insolvencia empresarial) is built so that a viable company can reorganize, and for that reason it strips effect from stipulations aimed at obstructing that process: early terminations, acceleration of maturity, and restrictions that penalize the debtor for entering the proceeding. No court ruling is needed for them to stop working.

There is also a cost for the creditor who presses on. If it tried to enforce that clause, its claim may be pushed behind all the others (postergación), and the security interests backing it may be lifted.

What does survive is what does not depend on the proceeding: breaches occurring after it begins, and properly constituted security interests.

Go back over your contracts with that distinction in hand. Separate the termination triggers tied to insolvency, which do not protect you, from those tied to objective, verifiable breaches, which do. And decide who monitors the financial health of your larger counterparties.

The governing-law and jurisdiction clause is usually negotiated last and copied from another contract, and it is one of the few that decides whether you hold an enforceable right or just an expectation.

In Colombia the rules on which court has jurisdiction are not set by the parties: procedural law is mandatory (de orden público) and private parties cannot replace it by agreement, except where the law allows it. So agreeing on a court abroad does not by itself close the door on a Colombian judge — least of all if your counterparty is domiciled here, or the obligations are performed here.

There are matters where Colombian law applies whatever the contract says, and the performance in Colombia of contracts signed abroad has a rule of its own. In commercial agency (agencia comercial, a figure of the Colombian Commercial Code) there is almost no room at all.

One cost few people budget for: if you do get a foreign law applied, it has to be proved to the judge, with official certifications or an expert opinion.

Before signing, separate two decisions that often get merged: choosing the law of the contract, and choosing who decides disputes. If what you want is a neutral, enforceable forum, look at whether international arbitration serves you better than a foreign court.

Whoever creates a work is its original owner — not the company that commissioned it, nor the one that pays the payroll. The law corrects this with a presumption that the rights pass to the employer or the commissioning party: narrow, and conditional.

The first condition is the one most often skipped: the contract must be in writing. A verbal instruction, an acceptance email or an invoice do not trigger the presumption, and without a written contract your company is standing on an argument, not on a right.

The second is scope. The transfer covers only what the company's ordinary activity required at the time the work was created. And if the contract sets no term and no territory, the law sets them for you — for less than people tend to assume.

There is one limit no clause can move: the author's moral rights (derechos morales) cannot be assigned or waived, however broad the clause.

Go back over the contracts your product was already built on, not just the next one. If the software, the design or the content your business rests on came out of service orders with no intellectual-property clause, put it in order before a sale or a license abroad.

A trademark registration is not a certificate you file away and forget. It is a right that holds for as long as the mark lives in the market. If it goes unused for several consecutive years, any interested party can ask for it to be cancelled.

What surprises our clients is not the cancellation itself but who has to prove what. The burden falls on the owner: you are the one who shows that the mark was used, on which goods and how regularly. Nobody has to prove that you did not use it.

Nor is cancellation always total. If you registered for a broad list of goods and only worked part of it, the registration is trimmed back to what actually reached the market.

And one detail decides the outcome: whoever obtains the cancellation is left in a preferential position to register that same sign (posición preferente, a figure of Andean trademark law). The mark does not merely leave your portfolio; it can end up in the hands of the party that challenged it.

Go through your portfolio class by class and ask what evidence you have from the past year: invoices, dated advertising, packaging, sales records. If a mark cannot show use, decide before someone else decides for you: put it to work, license it, or stop renewing it.

A recent law on identity theft comes into force in November. It requires telecommunications operators, financial institutions and other establishments that grant credit to adopt sufficient and reasonable measures to verify who is contracting and whether their documents are authentic.

The problem is that the law defines neither what is sufficient nor what is reasonable. It left that definition to the sector regulators, and the timetable they themselves announced places the guidelines at the very moment the obligation is already running.

That leaves a stretch in which you will decide on your own judgement, and it is not a stretch without consequences: if you fail to comply with the protocols, you must suspend collection, correct the report filed with the credit bureaus (centrales de riesgo, a Colombian figure with no exact equivalent) and return the defrauded money.

The Superintendencia de Industria y Comercio — Colombia's competition and consumer-protection authority — has an open public consultation on identity validation. If your business opens accounts, lends or sells in instalments, taking part is worth it both to influence the outcome and to understand where the standard is heading.

In the meantime, do what is within your reach: write down your verification procedure and leave a record of why you chose those controls and which alternatives you ruled out. When the claim arrives, that record is what you will be arguing about.

A trademark filing has two costs: the official fee and the professional work. Both are lost if the sign turns out to be unregistrable or if a third party with an earlier right opposes it. The clearance search is what tells you that before you spend.

Two things get confused. Checking that a name is available at the chamber of commerce, or that the domain is free, says nothing about the trademark: they are different registries with different rules. And a search is not a yes-or-no answer — it is an assessment of how close an earlier sign is, in which classes, and how likely the holder is to react.

What is worth deciding before filing: which classes you actually need (filing in more costs more and defends more), whether the sign is descriptive of what you sell — descriptive signs are the most common ground for refusal — and whether you will need the mark outside Colombia, because that changes the route: national filing, Madrid System, or a direct filing in the other country.

If an opposition has already been filed against you, that is a different conversation and it has a deadline. Write to us with the file number.

A subsidiary — normally an S.A.S. — is a Colombian company of its own, with its own legal personality and its own liability. A branch is the same foreign company operating in Colombia: it has no separate personality, and what happens here reaches the parent more directly.

The S.A.S. is the most used vehicle in the country and it is often described abroad as the Colombian LLC. It is not one. It is a stock company: it allows a single shareholder, does not require minimum capital, and gives unusual freedom to draft the bylaws — which is precisely why bylaws copied from a template tend to be the weakest part of the structure.

Three questions decide it in practice. Who will be liable if the operation goes wrong. How profits will be taken out and what withholding applies on the way. And whether the activity requires a licence or supervision that one figure obtains more easily than the other.

Registration of the foreign investment, the corporate filings and the tax consequences are three separate tracks that have to be planned together, not one after another. Tell us what you intend to do in Colombia and we will tell you which figure supports it.

Termination. Almost every dispute we see starts here. A contract with no clear notice period, no exit compensation and no rule on stock in the distributor's hands leaves both sides improvising at the worst moment.

Exclusivity. Exclusive of what: territory, channel, client list? And what happens if the distributor does not reach the volume that justified the exclusivity? Exclusivity without a performance condition is a gift.

Trademark use. The distributor will use your mark in advertising, on invoices, sometimes in a domain. Say what is licensed, for how long, and that it ends when the contract does — otherwise you spend the following year recovering your own brand.

Governing law and forum. Choosing a foreign law is easy to write and expensive to use. Consider where the assets are and where a judgment would have to be enforced, not only which law reads more comfortable.

Liability towards the end customer. In Colombia the consumer can claim against more than one link in the chain. Who responds, who bears the warranty and who handles the claim should be in the contract, not discovered when the first claim arrives.