Non-Disclosure Agreement Colombia (Acuerdo de Confidencialidad)

A Non-Disclosure Agreement Colombia (Acuerdo de Confidencialidad or NDA) is a bilateral or unilateral contract through which one or both parties commit to maintaining the confidentiality of information shared during a business relationship, governed by the principle of contractual autonomy (autonomía de la voluntad) established in Código Civil (CC) Article 1602 — which declares that lawful contracts constitute law between the parties — and supplemented by trade secret protections under the Decisión Andina 486 de 2000 (Régimen Común sobre Propiedad Industrial of the Comunidad Andina, comprising Colombia, Peru, Ecuador, and Bolivia).

The Constitución Política de 1991 provides the constitutional foundation through Article 333 (economic freedom and free enterprise), Article 61 (intellectual property protection), and Article 15 (right to privacy and protection of personal data — habeas data). The Código de Comercio (CCo — Decreto 410 de 1971) governs commercial obligations and establishes the duty of good faith (buena fe) in commercial dealings under CCo Article 863, which extends to pre-contractual negotiations where confidential information is commonly exchanged.

Under the Decisión Andina 486 de 2000 Articles 260 through 266, trade secrets (secretos empresariales) receive legal protection when they meet three requirements: the information is secret — not generally known or easily accessible to persons who normally deal with the type of information in question (Article 260 literal a); the information has commercial value because it is secret (literal b); and the holder has taken reasonable steps to maintain its secrecy (literal c). The Superintendencia de Industria y Comercio (SIC) — which in Colombia serves as both the intellectual property office and the competition authority — enforces trade secret protections through administrative proceedings, including injunctions and fines for misappropriation under Decisión 486 Article 266.

The Ley 1581 de 2012 (Ley de Protección de Datos Personales) and Decreto 1377 de 2013 impose additional obligations when the confidential information includes personal data of natural persons. The SIC, through its Delegatura para la Protección de Datos Personales, enforces data protection obligations and may impose sanctions of up to 2,000 SMLMV (approximately COP$2.847.000.000 for 2025) for violations. Where the NDA involves personal data processing, the agreement must address the roles of responsable del tratamiento (data controller) and encargado del tratamiento (data processor) under Ley 1581 Articles 17 and 18.

The Ley 1474 de 2011 (Estatuto Anticorrupción) added Article 308 to the Código Penal, criminalizing the unauthorized disclosure of business secrets (violación de reserva industrial y comercial) with imprisonment of two to six years and fines. Ley 1273 de 2009 (Ley de Delitos Informáticos) criminalizes unauthorized access to computer systems and data interception, providing additional criminal law protection for digital confidential information.

Colombian courts — Juzgados Civiles del Circuito for ordinary breach of contract claims and the SIC for trade secret and unfair competition complaints — have jurisdiction over NDA disputes. The Código General del Proceso (CGP — Ley 1564 de 2012) provides the procedural framework, with the possibility of medidas cautelares (precautionary measures under CGP Articles 590 through 598) to prevent ongoing disclosure of confidential information. Commercial arbitration before Centros de Arbitraje y Conciliación affiliated with Cámaras de Comercio is commonly used under Ley 1563 de 2012 (Estatuto de Arbitraje) for NDA disputes, particularly in cross-border transactions.

A Non-Disclosure Agreement Colombia is needed whenever parties to a business relationship — whether prospective, ongoing, or completed — exchange information that has commercial value by virtue of its confidentiality and requires protection against unauthorized disclosure, use, or reproduction.

An NDA is needed during pre-contractual negotiations (tratativas preliminares) governed by the principle of pre-contractual good faith under Código de Comercio Article 863. When companies explore potential partnerships, mergers, acquisitions (due diligence), investment opportunities, or licensing arrangements, the prospective parties must share sensitive financial, technical, and operational information before deciding whether to proceed. Under CCo Article 863, the duty of good faith extends to pre-contractual exchanges, but a specific NDA provides enforceable contractual obligations with defined scope, duration, and remedies that exceed the general duty of good faith.

The document is required when a company engages external consultants, contractors, or professional service providers — abogados, contadores, ingenieros, designers, marketing agencies — who will access proprietary business information during the engagement. Under CC Article 2142 (mandato) and the applicable service contract provisions, the service provider owes a general duty of loyalty, but an NDA specifies precisely what information is confidential, the permitted uses, and the obligations after the engagement ends.

An NDA is needed when Colombian companies enter into technology-related relationships — software development contracts, SaaS implementations, data analytics projects, or IT outsourcing arrangements. Under Ley 1273 de 2009 (Ley de Delitos Informáticos) and the Decisión Andina 486 de 2000, digital information including source code, algorithms, databases, customer lists, and technical specifications qualifies for trade secret protection when the three requirements of Article 260 are met — the NDA formalizes the obligation and establishes clear remedies.

The agreement is needed when companies share information with potential investors, venture capital funds, or angel investors regulated under Ley 2069 de 2020 (Ley de Emprendimiento). The due diligence process requires disclosure of financial statements, tax records, customer data, and business plans — all of which must be protected against use by investors who decide not to proceed with the investment.

An NDA is required when Colombian companies collaborate with international partners, suppliers, or distributors, particularly within the Comunidad Andina (Colombia, Peru, Ecuador, Bolivia) where the Decisión Andina 486 provides harmonized trade secret protection. Cross-border NDAs should address governing law, jurisdiction, and the enforcement mechanisms available in both jurisdictions.

A valid Non-Disclosure Agreement Colombia under CC Article 1602, the Decisión Andina 486 de 2000, and Ley 1581 de 2012 must contain the following essential elements to be enforceable before Colombian courts or arbitration tribunals.

Identification of Parties: Full legal name and identification of both parties — for natural persons: cédula de ciudadanía and domicile; for legal entities: company name (razón social), NIT (Número de Identificación Tributaria assigned by the DIAN), Cámara de Comercio registration, and identification of the representante legal authorized to sign the agreement. The NDA should specify whether it is unilateral (only one party discloses — the disclosing party and the receiving party) or mutual/bilateral (both parties disclose and receive confidential information).

Definition of Confidential Information: A precise definition of what constitutes "información confidencial" under the agreement. The definition should encompass: technical information (trade secrets, formulas, algorithms, source code, manufacturing processes, product designs); business information (financial statements, pricing strategies, customer lists, supplier terms, marketing plans, business projections); legal information (contracts, litigation strategy, regulatory filings); and personal data subject to Ley 1581 de 2012. The definition should reference the three requirements of Decisión Andina 486 Article 260 (secrecy, commercial value, and reasonable secrecy measures) to strengthen trade secret claims.

Exclusions from Confidentiality: Standard exclusions that define information not subject to confidentiality obligations: information that was publicly available at the time of disclosure or becomes public without breach by the receiving party; information already known to the receiving party before disclosure (with documentary evidence); information independently developed by the receiving party without reference to confidential information; and information disclosed pursuant to a legal obligation — court order, tutela compliance, DIAN audit requirement, SIC investigation, or CGP discovery orders — provided the receiving party gives prompt notice to the disclosing party.

Permitted Use and Obligations: Specification that confidential information may be used only for the stated purpose (propósito permitido) of the business relationship. The receiving party must: maintain confidentiality using the same degree of care applied to its own confidential information (but no less than reasonable care); limit access to employees, contractors, and advisors with a need to know, who are bound by equivalent confidentiality obligations; not copy, reproduce, or distribute confidential information except as necessary for the permitted purpose; and notify the disclosing party immediately of any unauthorized disclosure or use.

Duration: The term of the confidentiality obligation — typically two to five years from the date of disclosure, though trade secrets under Decisión Andina 486 are protected for as long as the secrecy conditions of Article 260 are maintained. The agreement should specify both the term during which information may be exchanged and the survival period of confidentiality obligations after the agreement terminates.

Remedies for Breach: Specification of the remedies available in case of breach — contractual damages (perjuicios) under CC Articles 1613 through 1617, injunctive relief (medidas cautelares under CGP Articles 590 through 598), and agreed liquidated damages (cláusula penal under CC Article 1592). The agreement may include a cláusula penal estimatoria specifying a fixed amount payable as pre-estimated damages, enforceable under CC Article 1600. Reference to criminal penalties under Código Penal Article 308 (violation of business secrets) and Ley 1273 de 2009 (cybercrime) may be included.

Return or Destruction of Information: Obligation to return or destroy all confidential information — including copies, notes, and digital files — upon termination of the agreement or at the disclosing party's written request. The receiving party should certify destruction in writing.

Governing Law and Dispute Resolution: Statement that the agreement is governed by Colombian law — CC, CCo, Decisión Andina 486, and Ley 1581 de 2012. Dispute resolution clause specifying jurisdiction: Juzgados Civiles del Circuito, SIC administrative proceedings for trade secret misappropriation, or commercial arbitration under Ley 1563 de 2012 before a Centro de Arbitraje y Conciliación affiliated with the Cámara de Comercio.

Forms-legal.com provides this Non-Disclosure Agreement Colombia template as a practical starting point for protecting confidential information in business relationships. Every NDA should be reviewed by an abogado comercialista or abogado de propiedad intelectual to confirm compliance with Decisión Andina 486, Ley 1581 de 2012 data protection requirements, and the specific circumstances of the disclosure relationship.