Where does cybersecurity legislation stand in Guatemala?

Last updated: September 28, 2026. This content is for informational purposes and does not constitute legal advice. The legislative status may change; always check the official sources.

Context

The discussion about a cybersecurity law in Guatemala has been going on for more than fifteen years. According to a count published by Infobae in June 2026, Congress had accumulated eight related bills since 2009 without any of them becoming law. Meanwhile, incidents such as the cyberattack on the Directorate General for Arms and Munitions Control (Digecam) in April 2026 have kept the issue on the public agenda.

An important point for companies: there is no single “Cybersecurity Law” in force. Current obligations derive from scattered rules and, in some sectors, from specific regulation.

Related legislation in force

Computer crimes in the Penal Code

Through Decree 33-96, the Penal Code (Decree 17-73) added articles 274 “A” to 274 “G”, which define, among others: destruction of computer records, alteration of programs, reproduction of computer instructions or programs, prohibited records, manipulation of information, and use of destructive information and programs. These offenses were drafted in the 1990s, so they don't expressly cover many current behaviors such as ransomware or certain forms of digital fraud.

Communications and electronic signatures

The Law for the Recognition of Electronic Communications and Signatures (Decree 47-2008) gives legal validity to electronic communications and regulates advanced electronic signatures and certification service providers.

Access to information and personal data

Guatemala does not have a general personal data protection law. The Law on Access to Public Information (Decree 57-2008) contains habeas data provisions and rules on the processing of personal data held by obligated parties (mainly public entities). The Constitution protects, among other things, the inviolability of correspondence, documents and books (article 24) and regulates access to state archives and records (article 31).

Public policy

In 2018 the Government presented the National Cybersecurity Strategy, with support from the Organization of American States (OAS). It is a policy instrument, not a law, and it does not create direct obligations for the private sector. According to Infobae, the GT-CERT response team operates without a legal mandate that would allow it to impose obligations on private companies.

Relevant bills

Sources: Congress of the Republic, Infobae, Emisoras Unidas, Prensa Libre (see list at the end; all in Spanish).

International conventions

Guatemala received an invitation from the Council of Europe to accede to the Convention on Cybercrime (Budapest Convention); accession requires domestic legislative approval. As of this update, we have not found in the sources consulted that accession has been completed.

Sector regulation: the financial system

Entities supervised by the Superintendency of Banks are subject to specific technology risk regulation issued by the Monetary Board. In 2025, Resolution JM-98-2025, the Regulation for Technology Risk Management, was issued; according to published analyses it replaces the previous JM-104-2021 and includes requirements on IT governance, information security, cybersecurity, incident management, continuity and third-party management. See the official text at the Bank of Guatemala or the Superintendency of Banks.

Implications for companies

• The lack of a comprehensive law doesn't eliminate the risk. An incident can create civil, contractual and criminal liability (for the perpetrator) and, above all, operational and reputational losses.
• International customers, parent companies and partners often require standards (for example, ISO/IEC 27001 or NIST CSF) regardless of local law.
• Financial system companies and their technology providers already have concrete obligations.
• If any of the bills is passed, it will likely introduce risk management, audit and incident reporting obligations, at least for critical infrastructure and public entities.

Recommendations for companies

1. Appoint an information security officer with access to leadership.
2. Inventory which personal data you process, where it is and who accesses it.
3. Adopt a recognized reference framework and measure your maturity.
4. Define an incident management procedure that includes legal counsel and criteria for filing a complaint with the Public Prosecutor's Office.
5. Review contracts with technology providers: confidentiality, incident notification and continuity.
6. Follow the bills and prepare your organization before they become mandatory.

Conclusions

Guatemala still has no comprehensive cybersecurity law, but the framework isn't empty: computer crimes, electronic signatures, access to information and financial regulation already impose rules. Companies that get ahead with governance, risk management and incident response will be better protected and better prepared for the regulation to come.

This content is for informational purposes and does not constitute legal advice.

Frequently asked questions

Sources

• Infobae — Guatemala lleva 17 años sin aprobar una ley de ciberseguridad y el Congreso acumula ocho iniciativas pendientes (06/10/2026)
• Emisoras Unidas — Impulsan ley para castigar ciberdelitos en Guatemala (07/31/2026)
• Emisoras Unidas — Comisión de Asuntos de Seguridad analiza Iniciativa de Ley de Protección de Datos Personales (07/16/2026)
• Prensa Libre — Congreso oficializa que se archiva el decreto 39-2022
• Congress of the Republic — Bill 6347 (PDF)
• Congress of the Republic — Committee report on the Cybersecurity Law bill (2025)
• UNODC — Penal Code of Guatemala, articles 274 A–G
• Ministry of the Interior — National Cybersecurity Strategy (PDF)
• OAS — Guatemala and the Dominican Republic present their National Cybersecurity Strategy (2018)
• Banguat — Resolution JM-104-2021 (PDF, previous version)
• WhiteJaguars — Resolution JM-98-2025: technology risk (analysis)