Skip to main content
project@netbasejsc.com
Mon–Sat: 9:00–18:15, Sun: closed
91 Nguyen Chi Thanh, Hanoi
Facebook X (Twitter) LinkedIn YouTube

What are you looking for?

Explore our services and discover how we can help you achieve your goals

Colombia software delivery: Law 1581, DIAN e-invoicing, PSE and Bre-B

Scoping a software project for buyers or users in Colombia means settling four decisions early: how Law 1581 of 2012 and the Superintendence of Industry and Commerce (SIC) govern consent and the national database registry, whether DIAN's electronic invoicing applies to your billing, whether PSE or the Bre-B instant payment system reaches checkout, and which Spanish-language interface ships at launch.

Submit a project Explore custom engineering

Reviewed by Huy Nguyen (David), CEO · Updated 20 Oct 2026 · 12 min read

star

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Colombian rules actually require from what Netbase can evidence about its own practice, with official sources named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first. If you are instead a North American buyer deciding where your engineering team should be based, Vietnam vs Latin America for software outsourcing compares that sourcing decision directly.

Contents

Who enforces data protection for a Colombia-facing product?

Law 1581 of 2012 is Colombia's general data protection regime: it applies to personal data in any database that makes it subject to processing in Colombian territory by a public or private entity, and to a controller or processor not established in Colombia when Colombian law applies to it under international norms and treaties. The Superintendence of Industry and Commerce (SIC) is Colombia's data protection authority. It administers the National Database Registry (RNBD), the public directory of the databases subject to processing that operate in the country; since Decree 090 of 2018, the duty to register falls on companies and non-profit entities with total assets above 100,000 tax value units (UVT) and on public entities, and a database created now must be registered within two months of its creation.

None of that changes because the development team sits outside Colombia. What changes is who registers the database with the SIC, who is named the responsible party for its treatment, and who answers the SIC if a Colombian user complains. A buyer should settle those roles before discovery starts, not after a defect surfaces.

What can Netbase evidence for a Colombia-facing brief?

Procurement and security reviewers tend to ask for the same three statements. These are the ones Netbase can give.

  • Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. The buyer maps these practices to the responsible party's own Law 1581 duties for a Colombia-facing system.
  • Hours and delivery language. Netbase delivery communication is in English. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days. Bogota runs on UTC−5 all year with no daylight saving, twelve hours behind Hanoi, so that window falls between 21:00 the previous evening and 06:15 Bogota time, outside the Colombian working day.
  • Reach. Netbase has worked with clients in 80 countries.

Netbase JSC's Clutch profile also carries a review from Bogota: Oscar Salamanca, E-Commerce Manager, Apparel Company (Bogota, Colombia), reviewing "E-Commerce Web Dev for Apparel Company" on Clutch, 2020-10-16, rated 5.0, wrote: "The project was developed and delivered before the estimated delivery date."

Which requirement sits with which decision owner?

A Colombia-facing brief spreads the decision across five separate owners, and a proposal that blurs them tends to promise more than any one team can actually check once the contract is signed.

Decision area What Colombian rules and infrastructure expect What a supplier can evidence Who decides
Data protection Registration of the personal database in the RNBD and a lawful basis for its treatment A data processing agreement, an access matrix, a tested breach-response plan Data protection lead
E-invoicing A structured electronic sales invoice issued with prior validation for invoicing-obligated sellers A tested invoicing integration and a sample validated invoice Finance systems owner
Payments PSE bank transfers or Bre-B instant transfers at checkout, alongside cards A tested payment flow with a fallback for a failed or delayed transfer Product owner with payments provider
Accessibility WCAG 2.1 AA conformance for the public-sector sites and systems the standard reaches Per-journey test results with assistive technology, a defect log Product or service owner
Language A Spanish-language journey for consumer-facing screens A named copy owner and a tested translation workflow Localisation owner

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Which steps come before a Colombia-facing launch?

  1. Register the database and trace its treatment

    Decide who is the responsible party for each personal database the product creates, and register it in the RNBD where the law requires it.

  2. Scope DIAN e-invoicing

    If the business is an invoicing-obligated seller, build or integrate a path to issue a validated electronic invoice, with a paper fallback reserved for a genuine technical failure.

  3. Add PSE and Bre-B

    Decide whether PSE bank transfers, Bre-B's instant key-based transfers, or both sit at checkout alongside cards, and design a fallback for a transfer that does not confirm.

  4. Scope Spanish-language copy

    Decide which consumer journeys ship in Spanish at launch, and name an owner for translation review.

  5. Decide go-live readiness

    Check the database registration, the e-invoicing connection, the payment flows and the language scope against the plan, and record the decision with its owner.

  6. Launch and keep the record current

    Keep the RNBD registration and breach-response plan current, and re-test the payment and invoicing integrations after any provider or rule change.

Diagram of a Colombia-facing launch pipeline: register the database, scope DIAN e-invoicing, add PSE and Bre-B and scope Spanish-language copy, then decide readiness before launch and keep the record current
Diagram of a Colombia-facing launch pipeline

Worked scenario: a Bre-B transfer that has not settled

A retailer adds Bre-B alongside PSE and cards so shoppers can pay to the store's registered key straight from their own bank or wallet app.

  1. Key shown

    The checkout shows the store's Bre-B key or a QR code carrying the order amount

    Owner
    Engineering

  2. Sent by the payer

    The shopper sends the transfer from their own financial institution's app, outside the merchant's control

    Owner
    Engineering

  3. No immediate confirmation

    The transfer confirmation does not arrive before the checkout's wait window closes

    Owner
    Product owner

  4. Status checked

    The checkout queries the transfer status rather than assuming failure, because the interoperating institution may still confirm shortly after

    Owner
    Engineering

  5. Fallback offered

    If no confirmation arrives in the agreed window, the checkout offers PSE or a card as a fresh attempt, not a second Bre-B transfer

    Owner
    Product owner

  6. Reconciliation

    Finance matches the settlement report against orders the next working day, by merchant reference

    Owner
    Finance owner

A proposal that cannot describe steps 3 and 5, specifically what happens when a Bre-B confirmation does not arrive, has not yet scoped Colombian payments for this product.

What has Netbase built that is relevant to a Colombia-facing brief?

The closest published example of guided commerce ordering work is for ACT Printing, a custom apparel and print shop: Netbase upgraded the existing online store with a guided, mobile-first ordering flow across three to four priority product groups, including print-location zones, garment colour selection and a grouped size-package builder with a live total, built and tested on staging with client acceptance testing over about 20 to 25 working days; the apparel ordering flow upgrade record has the detail. E-commerce development is the service that scopes a guided ordering flow like this one for a Colombia-facing store.

Which questions should you ask a supplier?

  • Who is the responsible party for this database, and is it registered in the RNBD? Expect a clear answer before contract, not during a breach.
  • Which electronic invoicing route have you actually integrated? Ask for a validated sample invoice, not a slide.
  • What happens in your checkout when a Bre-B or PSE confirmation does not return? Look for a status check and a fallback, not a second charge.
  • Who owns the Spanish copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.
  • What handover rhythm do you propose given the twelve-hour gap to Bogota? Ask for a concrete written rhythm, not a time-zone label.
  • What is out of scope for the first release? A good proposal names it rather than leaving it implicit.

What usually goes wrong?

  • Database registration skipped until a complaint arrives. Signal: nobody can say whether the product's personal databases are registered in the RNBD. Owner: the data protection lead, who should register before launch, not after a complaint.
  • E-invoicing treated as a reporting feature added at the end. Signal: the integration cannot issue a validated invoice and falls back to paper by default. Owner: the finance systems owner, scoping the connection at discovery.
  • Only one payment method tested end to end. Signal: a Bre-B or PSE confirmation delay leaves an order stuck with no fallback. Owner: the product owner.
  • The twelve-hour gap assumed away. Signal: a proposal promises same-day live calls without saying when they fall or who joins them outside office hours. Owner: the buyer, by asking for a written async handover rhythm instead.

How this guide is sourced and where it stops

This guide draws on the Superintendence of Industry and Commerce's own description of Law 1581 of 2012 and the National Database Registry, DIAN's own compiled invoicing resolution, Banco de la Republica's own description of Bre-B, and MinTIC's own compiled digital accessibility resolution, all checked on 2026-10-19 and described as in force on that date, together with company statements and review evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Colombia-facing brief. It does not decide which registration, invoicing route or language boundary fits your organisation; your own advisers make that call.

Plan the next step for your project

Submit a project Explore custom engineering

Common questions

Where the team sits does not decide it. The law applies to processing in Colombian territory, and it also reaches a controller or processor not established in Colombia when Colombian law applies under international norms and treaties; confirm your specific case with your own advisers.

Neither is mandatory by law for a private store; offer the methods your own customers use alongside cards, and test your own customer base before dropping either.

Not always. Many buyers ship the journeys Colombian customers use most in Spanish and keep less-used screens in another language, provided the boundary is written down and a named owner reviews Spanish copy before each release.

MinTIC's Resolución 1519 de 2020 has set WCAG 2.1 AA, from 1 January 2022, as the standard for the public-sector sites and systems it covers; confirm with your own advisers whether a specific private product falls inside its scope.

Yes, when the invoice format and the validation step are scoped with the same care as any other billing integration, and tested before launch.

Written daily hand-offs carry the detail, and a short call slot, agreed in advance and outside one side's office hours, covers anything that genuinely needs a live conversation; remote delivery governance sets out how that rhythm is run day to day.

Plan the first release

Bring your RNBD registration decision, your DIAN e-invoicing route, your PSE and Bre-B payment scope and your Spanish-language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how a written handover rhythm is agreed when hours do not overlap. If your brief also reaches Asia, the India guide covers that market's own data, payment and language decisions; if it reaches North America instead, the United States guide and the Canada guide cover those markets directly.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Colombia-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Custom product engineering for a bounded release outcome Custom product engineering for a bounded release outcome

One defined release of your product, built to named outcomes and handed over with acceptance evidence.

Learn More
line

Sources

91 Nguyen Chi Thanh, Hanoi

+84 937 869 689

Tell us what you want to build or automate.

Submit a project