Cybersecurity law & regulation in Bolivia (2026)
Cybersecurity in Bolivia: sectoral rules.
Bolivia has no comprehensive cybersecurity law; its operative framework is built on sectoral and public-sector-specific rules. AGETIC (the digital-government agency) operates the CGII national incident response centre, which mandates 24-hour incident reporting by all public entities. A national cybersecurity strategy is under development with EU/LAC4 support, and a data-protection bill remains pending in Congress.
Legal framework
Law No. 164 on Telecommunications (2011) and Supreme Decree No. 2514 (2015) establishing AGETIC and the CGII; Electronic Government Implementation Plan 2025-2028 (Supreme Decree No. 5468, 1 October 2025)
Key points: cybersecurity in Bolivia
Primary Regulatory Authority
AGETIC (Agencia de Gobierno Electrónico y Tecnologías de Información y Comunicación), established by Supreme Decree No. 2514 (2015) under Law No. 164, is Bolivia's central digital-government and cybersecurity body. Its CGII (Centro de Gestión de Incidentes Informáticos) functions as the national computer incident response team for the public sector.
24-Hour Public-Sector Incident Reporting
All public-sector information security officers must notify the CGII of cybersecurity incidents within 24 hours of discovery. This is the principal breach/incident notification duty currently in force and applies exclusively to state entities; no equivalent private-sector obligation exists.
Electronic Government Plan 2025-2028
Supreme Decree No. 5468 (1 October 2025) approved the updated Electronic Government Implementation Plan (PIGE 2025-2028), which designates cybersecurity and incident management as one of three strategic pillars and requires each public entity to maintain an Institutional Information Security Plan.
Cybercrime Criminal Code Provisions
Chapter XI of Bolivia's Criminal Code (as amended, 1997) criminalises unauthorised access, manipulation, and illegal acquisition of computer data. There is no standalone cybercrime statute; these provisions are embedded in the general penal code and are the only criminal-law recourse for cyber incidents against private actors.
No Comprehensive Law or Data Protection Act
Bolivia has no general personal data protection law and no NIS2-equivalent cybersecurity statute. Multiple data-protection bills have been proposed but remain stalled in Congress. Bolivia also missed the Andean Community's July 2024 deadline requiring member states to align domestic legislation with community cybersecurity guidelines.
National Cybersecurity Strategy in Development
Bolivia launched a national cybersecurity strategy development and implementation process in December 2024 with technical support from the EU-funded LAC4 programme. No national cybersecurity strategy has been formally adopted as of mid-2026; the process remains ongoing.
Timeline of decisions
- GuidanceSupreme Decree 5468: Electronic Government Implementation Plan 2025-2028 with Cybersecurity Pillar
Bolivia enacted DS 5468 to update its Electronic Government Plan through 2028, adding a dedicated cybersecurity and incident-management pillar alongside digital sovereignty and interoperability objectives; all Executive Branch entities must align their institutional security plans with CGII guidelines.
LexiVox — DS 5468 text
- Guidance · officialSupreme Decree 5367: Agenda Digital 2030, Cybersecurity as a National Strategic Axis
President Luis Arce signed Bolivia's Agenda Digital 2030, a medium-term public policy instrument managed by AGETIC; cybersecurity and incident management are among its five strategic pillars, binding the Executive Branch to prioritise secure, sovereign digital infrastructure through 2030.
AGETIC (official)
- Law · officialSupreme Decree 2514: AGETIC and CGII (National CSIRT) Created; Mandatory Public-Sector Security Plans
The most significant cybersecurity governance milestone: DS 2514 created AGETIC as the central e-government authority and established the CGII as Bolivia's national CSIRT; it mandated every public entity to maintain an Institutional Information Security Plan and report incidents to CGII within 24 hours of discovery.
CGII / AGETIC (official)
- LawSupreme Decree 1793: Implementing Regulation for Law 164, Digital Certification, E-Government, and Security
DS 1793 issued the operational regulation for Law 164, governing digital certification authorities, electronic signatures, e-government services, and mandatory use of free software in public administration, establishing the technical-legal backbone for state cybersecurity practices.
LexiVox — DS 1793 text
- Law · officialLaw No. 164: General Telecommunications, ICT, and Postal Services Law, Foundational Cybersecurity Framework
Law 164 is the foundational statute for Bolivia's digital regulation: it established the legal basis for e-commerce, electronic signatures, and digital communications, and introduced cybercrime offences into the Penal Code (Arts. 179 bis, 363 bis, 363 ter) covering unauthorised access, data manipulation, and ICT sabotage.
Ministry of Education Bolivia (official)
- Law · officialLaw 1768 Amends Penal Code, First Criminal Sanctions for Computer Data Misuse
Law No. 1768 (promulgated 10 March 1997) modified the Bolivian Penal Code to insert Articles 363 Bis (Computer Manipulation, fraudulent alteration of data processing, 1-5 years imprisonment) and 363 Ter (Unlawful Alteration, Access, and Use of Computer Data), providing Bolivia's earliest criminal-law deterrent against misuse of personal data. These articles remain the principal criminal sanction in the absence of a comprehensive data-protection law.
OAS – Bolivian Penal Code (Ley 1768)
- Law · officialLaw 1768: Penal Code Amended, First Cybercrime Provisions (Art. 363 bis & ter)
Law 1768 inserted Chapter XI 'Computer Crimes' into the Bolivian Penal Code, creating Article 363 bis (computer manipulation for financial gain, 1-5 years) and Article 363 ter (unauthorised access or alteration of computer data). Enacted before widespread internet use, these two articles remain Bolivia's only specific cybercrime provisions in the Penal Code and are widely criticised as inadequate against modern threats such as ransomware, phishing, and DDoS attacks.
UNODC Cybercrime Legislation Database
Sources
- cgii.gob.bo/es/acerca-del-cgii
- cgii.gob.bo/es/normativa
- lexivox.org/norms/BO-DS-N5468.xhtml
- agetic.gob.bo/sites/default/files/2025-12/ARTICULO%207%20OFICIAL-1_0.pdf
- resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/latin-america/bolivia/top
- eurocloud.org/news/article/towards-a-data-protection-law-in-bolivia-digital-progres
- lac4.eu/event/national-cybersecurity-strategy-development-and-implementation-
- internetbolivia.org/file/2024/11/fdd_03.pdf
- agetic.gob.bo/normativa/normativa-nacional
Next for Bolivia: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026