Cybersecurity law & regulation in Guatemala (2026)
Cybersecurity in Guatemala: proposed.
Guatemala lacks a comprehensive, enacted cybersecurity law as of May 2026. A draft Cybersecurity Law (Initiative 6347) received a favorable committee opinion from the Commission on National Security Affairs in August 2025 and was still advancing through congressional plenary debate as of April 2026, with passage delayed by expert concerns over legal gaps and constitutional risks. The only operational cybersecurity body is the GT-CERT under the Ministry of Government, which functions without a statutory mandate.
Legal framework
No comprehensive cybersecurity law in force; Initiative 6347 (Ley de Ciberseguridad) pending in Congress; GT-CERT operated informally by the Ministerio de Gobernación
Key points: cybersecurity in Guatemala
No comprehensive cybersecurity law in force
Guatemala has no enacted, standalone cybersecurity statute. Decree 39-2022 (Law on Prevention and Protection against Cybercrime) was approved by Congress in August 2022 but was never forwarded to the Executive for promulgation and was subsequently archived.
Initiative 6347, Cybersecurity Law pending
Initiative 6347, filed in early 2024, received a favorable opinion from the Commission on National Security Affairs on 26 August 2025 and moved to plenary debate. As of April 2026, passage remained stalled due to expert concerns about structural inconsistencies and potential unconstitutionality.
Proposed CSIRT-GT and incident reporting
Initiative 6347 would create the Centro de Respuesta a Incidentes de Seguridad Informática de Guatemala (CSIRT-GT) as the national incident-coordination body, and would require all state institutions to designate information security officers and report incidents, but these obligations are not yet law.
Existing GT-CERT (informal)
The Ministerio de Gobernación operates GT-CERT Guatemala, which issues monthly cybersecurity bulletins and coordinates national cyber-incident response. It functions without a statutory legal basis and imposes no mandatory reporting duties on the private sector.
Proposed cybercrime offences (criminal law)
Initiative 6347 would codify eleven cybercrime offences in the Penal Code, including unlawful system access, data interception, computer fraud, and identity theft, with penalties of 6 to 30 years. No dedicated cybercrime chapter currently exists in Guatemalan criminal law.
Budapest Convention, not yet ratified
Guatemala received an official Council of Europe invitation to accede to the Budapest Convention on Cybercrime and has worked with the CoE's GLACY-e programme to align domestic legislation, but had not ratified or acceded as of mid-2025; accession is contingent on passage of domestic legislation such as Initiative 6347.
Timeline of decisions
- DecisionCybersecurity Bill Initiative 6347 Returned to Committee After First Plenary Debate
Guatemala's Congress sent Initiative 6347 back to commissions for further revision after its first plenary reading, following concerns raised by banking, telecom, and civil-society sectors over military oversight provisions and potential chilling effects on free expression; a revised favorable opinion with modifications was subsequently issued.
CiberLATAM
- Law · officialNew Cybersecurity Bill (Initiative 6771) Introduced Amid Surge in Attacks
Congress received Initiative 6771, proposing a National Cybersecurity System coordinating incident response across state institutions, adding to a backlog of eight pending cybercrime and data-security bills with none yet enacted. Guatemala's lack of criminal sanctions for data breaches leaves personal data processing entirely unregulated under criminal law.
Congreso de la República de Guatemala
- Law · officialInitiative 6347 Cybersecurity Law Clears Congressional Committee
The Congressional Commission on National Security Affairs issued a favourable opinion on Initiative 6347 after 18 months of analysis, clearing it for full plenary debate. The bill typifies eight new cyber offences, establishes CSIRT-GT as a national incident-response centre, and aligns Guatemala with the Budapest Convention framework.
Congreso de la República de Guatemala
- Decision · officialCongress's National Security Commission Approves Initiative 6347 — Guatemala's First Dedicated Cybersecurity Bill
The National Security Commission issued a favorable opinion on Initiative 6347, which proposes creating a National Cybersecurity Council, a National Cybersecurity Directorate, and a CSIRT-GT incident-response center, with criminal penalties of up to 30 years for specified offenses; civil liberties groups warned that broad offense definitions risk criminalizing investigative journalism and whistleblowing.
Congreso de la República de Guatemala
- Incident · officialGuatemala Records Over 214 Million Attempted Cyberattacks in First Half of 2025 With No National Framework
Guatemala suffered more than 214 million cyberattack attempts in the first six months of 2025 with no national cybersecurity framework, no dedicated CSIRT, and no comprehensive data-protection law in place, demonstrating the acute regulatory vacuum that Initiative 6347 is designed to address.
U.S. International Trade Administration
- Guidance · officialFirst Inter-Institutional Cyber Defence Tabletop Exercise Conducted
The Ministry of Governance organised Guatemala's inaugural multi-institution cyber defence tabletop exercise to test inter-agency coordination for major cyber incidents, reflecting growing institutional capacity building supported by the OAS and UNODC.
GT-CERT / Ministerio de Gobernación
- Law · officialCybersecurity Law Bill 6347 Formally Submitted to Congress
Deputies from the CREO caucus submitted Initiative 6347, Guatemala's first comprehensive cybersecurity bill, proposing codified cyber offences, a formal legal framework for digital security obligations, and the statutory creation of a national CSIRT-GT under the National Security Council.
Congreso de la República de Guatemala
- IncidentAnonymous DDoS Attack Disables Multiple Government Websites
Hacktivists affiliated with Anonymous took down numerous Guatemalan government webpages for several days via distributed denial-of-service attacks in solidarity with indigenous-led pro-democracy protests; the incident exposed institutional gaps in cyber resilience with no dedicated cybercrime law in force.
JURIST Legal News
- DecisionCongress Archives Cybercrime Decree 39-2022 After Press Freedom Backlash
With 112 votes, Congress voted to archive Decree 39-2022 weeks after passing it, following warnings from civil society and press organizations that its broad provisions on 'false information' would be weaponized against journalists. The reversal left Guatemala without any cybercrime or data-security criminal framework.
Prensa Libre
- LawCongress Archives Cybercrime Decree 39-2022 After Civil Society Backlash
Just 20 days after passing it, Congress voted 112-to-archive Decree 39-2022 following mass protests from journalists, civil-society organisations, and human rights groups who argued it criminalised free expression and enabled state censorship; Guatemala was left again without a dedicated cybercrime statute.
IPANDETEC
- Law · officialCongress Passes Cybercrime Law Decree 39-2022 (Later Reversed)
With 100 votes in favour, the Guatemalan Congress approved the Law on Prevention and Protection against Cybercrime, the country's first standalone cybercrime statute, creating criminal sanctions for unauthorised system access, data breaches, and malware distribution; it never entered into force.
Congreso de la República de Guatemala
- DecisionJunta Monetaria Issues JM-104-2021: Technology Risk Management Regulation for Financial Institutions
Resolution JM-104-2021, adopted in extraordinary session on November 26, 2021, established a comprehensive technology-risk framework for all banks and financial groups, requiring formal risk committees, information-security controls, and operational-resilience planning. It updated the 2011 predecessor to reflect digital-banking growth and was itself replaced by JM-98-2025 in October 2025.
BD Vanguardia
- Decision · officialAcuerdo Gubernativo 200-2021 Establishes National Cybersecurity Committee (CONCIBER)
The Executive created CONCIBER via Government Agreement 200-2021, formalising an advisory body to the National Security Council tasked with overseeing implementation of the National Cybersecurity Strategy; the committee held a four-year mandate running to late 2025.
Secretaría Técnica del Consejo Nacional de Seguridad
- Guidance · officialGuatemala Publishes First National Cybersecurity Strategy
The Ministry of Governance officially launched Guatemala's National Cybersecurity Strategy, structured around four pillars, legal frameworks, technical capabilities, education and culture, and international cooperation, and calling for the creation of a national CSIRT-GT in alignment with the OAS AG/RES. 2004 inter-American cybersecurity mandate.
Ministerio de Gobernación de Guatemala
- Law · officialPenal Code Amended to Add First Cybercrime Articles (Arts. 274A–274B)
Guatemala introduced Articles 274A (destruction of computer records) and 274B (unauthorized alteration of programs) into its Penal Code, each carrying six months to four years' imprisonment — the country's inaugural codified cybercrime provisions, narrowly scoped to record destruction and not covering online speech, networks, or platforms.
ITU Cybersecurity Country Profile — Guatemala
Sources
- congreso.gob.gt/assets/uploads/info_legislativo/iniciativas/ea912-6347.pdf
- congreso.gob.gt/noticias_congreso/14233/2025/3
- gtcert.mingob.gob.gt/
- mingob.gob.gt/boletin-de-ciberseguridad-octubre-2024-gt-cert/
- ipandetec.org/guatemala/sobre-el-decreto-39-2022-que-contiene-la-ley-de-prevencion-
- coe.int/en/web/cybercrime/-/glacy-e-guatemala-working-on-national-legislation
- prensa-latina.cu/2026/04/14/guatemala-congreso-por-aprobar-leyes-antilavado-y-de-ciber
- lahora.gt/nacionales/dguzman/2026/04/19/que-es-la-csirt-gt-que-se-busca-crear-e
- congreso.gob.gt/noticias_congreso/8867/2022/4
- prensalibre.com/guatemala/justicia/estos-son-los-nuevos-ciberdelitos-que-se-castigari
- congreso.gob.gt/noticias_congreso/13372/2025/4
- coe.int/en/web/cybercrime/parties-observers
Next for Guatemala: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026