NDA in Colombia: Template, Key Clauses and Local Law (2026)

What an NDA is under Colombian law A non-disclosure agreement in Colombia, an acuerdo de confidencialidad, is a contract in which one or both parties promise to protect information they receive and to use it only for an agreed purpose. It rests on two foundations. The first is freedom of contract under the Codigo Civil: a lawful agreement is binding law between the parties. The second is the Andean trade secret regime, Decision 486 of 2000 of the Comunidad Andina, which protects undisclosed business information and expressly supports confidentiality obligations. An NDA in Colombia therefore does two things at once: it creates contractual duties you can sue on, and it helps prove that you took the reasonable measures that a trade secret must have to stay protected under Decision 486. ## The core rules that shape a Colombian NDA Trade secrets under Decision 486. Decision 486 protects undisclosed information that is secret, has commercial value because it is secret, and is kept confidential through reasonable protective measures. An NDA is one of those reasonable measures. If the information leaks because you never protected it, the trade secret protection can be lost. Unfair competition. Law 256 of 1996 on unfair competition can give a remedy where a competitor acquires or uses secret information improperly, alongside the contractual claim. Data protection (Ley 1581 de 2012). If the information includes personal data, the Colombian data protection statute applies. The receiving party should process personal data only for the authorised purpose, apply security measures, and respect the roles of controller and processor and the instructions of the Superintendencia de Industria y Comercio (SIC). The NDA should address this where personal data is involved. Remedies. Breach can lead to damages and injunctive relief. Serious misuse of secrets may also engage criminal provisions. The strength of a claim depends on how clearly the NDA defined the confidential information and the obligations. ## Mutual or one-way, and how far to reach Decide early whether the NDA is one-way (only one side discloses) or mutual (both do). Evaluating a potential partnership, a joint venture or an acquisition usually calls for a mutual agreement, because information flows both ways; a vendor pitch where only you reveal plans may justify a one-way obligation. Getting this wrong tends to produce a lopsided document that the other side resists signing. Be realistic about reach as well. An NDA binds the parties and, through the obligations clause, the people they allow to see the information, but it cannot by itself stop a competitor who independently develops the same idea, and it cannot revive secrecy once the information is genuinely public. That is why the carve-outs matter: they keep the agreement credible by not claiming to control what it cannot. For information you truly need to protect long term, pair the NDA with practical measures (limited access, marking documents as confidential, secure systems), because under Decision 486 the trade secret survives only while you actually keep it secret. An NDA that is backed by real protective habits is worth far more than one that sits unread in a drawer while the information circulates freely. ## A usable template Adapt to your facts and have a Colombian lawyer review it where the stakes are high. ACUERDO DE CONFIDENCIALIDAD / NON-DISCLOSURE AGREEMENT 1. Parties. [Disclosing party] and [Receiving party], with identity or NIT numbers. [State if mutual.] 2. Purpose. The information is shared only to [evaluate / perform ...]. 3. Confidential information. Defined as [non-public business, technical, financial and commercial information, in any form], with the usual carve-outs below. 4. Exclusions. Information that is public through no fault of the receiver, already lawfully held, independently developed, or lawfully received from a third party. 5. Obligations. Keep the information secret, use it only for the Purpose, limit access to those who need it and are bound by equivalent duties, and apply reasonable security measures. 6. Personal data. Where the information includes personal data, the Receiving party processes it only for the Purpose, under the controls required by Law 1581 of 2012 and the SIC. 7. Term. Confidentiality lasts [term], and for trade secrets for as long as the information stays secret. 8. Return or destruction. On request or at the end, return or destroy the information and copies. 9. Remedies. Breach entitles the disclosing party to damages and injunctive relief. 10. Governing law and jurisdiction. Colombian law; courts of [city]. Signatures, identity or NIT numbers, date. ## A short walk through the key clauses Definition of confidential information is the clause that decides most disputes. Too narrow and real secrets fall outside it; too wide and a court may treat it as unreasonable. Tie it to the purpose. Personal data deserves its own clause whenever personal information changes hands, because Law 1581 duties sit on top of the contract and the SIC enforces them. Term should separate ordinary confidential information, which can have a fixed period, from trade secrets, which stay protected under Decision 486 for as long as they remain secret. ## Red flags to check before signing - A vague definition of confidential information that either protects nothing or claims to cover everything.

• No carve-outs for public, pre-held or independently developed information.
• Personal data flowing with no reference to Law 1581 duties and the controller and processor roles.
• A fixed short term applied to genuine trade secrets, cutting protection short.
• No return or destruction obligation and no clear remedy clause. ## Keeping the NDA under control after signing An NDA is only as good as the care you take after signing: who received what, for what purpose, for how long, and when information must be returned or destroyed. Across many counterparties these obligations scatter quickly. Drafting the NDA from a clear template, checking that the definition and carve-outs are sound and that personal data is handled under Law 1581, and keeping the terms and return dates in one place can sit in a single AI workspace tuned to how your company shares information. Adira is built around that idea: it drafts from a template, models the contract as linked clauses so it can flag a weak definition or a missing data clause, and keeps obligations and dates together. Adira is India-first today, with jurisdiction set per contract and an international mode for others; deep, verified coverage of Colombian law is on its roadmap rather than established, so treat Colombia specific output as a draft for a Colombian lawyer to confirm. This page is general information, not legal advice. Colombian rules change, so confirm the current position for your situation.