News
What was reported
According to Infobae (June 10, 2026), bill 6347, introduced in March 2024, received a favorable committee report on August 26, 2025, was discussed in first reading on September 9 and in second reading on September 23, 2025. On April 14, 2026, the full Congress sent it back to committee with 94 votes. The proposal included creating the Guatemala Computer Security Incident Response Center (CSIRT-GT) and defining 11 computer crimes.
Analysis
What it means
Sending it back to committee prolongs the absence of a comprehensive framework. In practice, companies will continue without general obligations to report incidents or manage cyber risks, except those already imposed by sector regulations or contracts. This doesn't reduce exposure: it only shifts the responsibility to prepare onto each organization.
Recommendation
What to do now
Use the time to your advantage: implement today the controls that will likely be required tomorrow —risk management, designated owners, an incident procedure and data protection— and follow the bills on the Congress website.
Conclusions
The law may take a while; attackers won't wait.
Frequently asked questions
What did bill 6347 propose?
Creating a CSIRT-GT to coordinate incident response and defining 11 computer crimes punishable by prison, according to Infobae.
Sources
- Infobae — Guatemala lleva 17 años sin aprobar una ley de ciberseguridad (06/10/2026)
- Congress of the Republic — Bill 6347 (PDF)
Bring this topic to your organization
The Seguridad 360 Course turns these ideas into habits. Next edition: October 31, 2026 (taught in Spanish).