Data protection & privacy law in Guatemala (2026)
Data protection in Guatemala: proposed.
Guatemala has no enacted comprehensive personal data protection law as of May 2026. The Law on Access to Public Information (Decree 57-2008) provides limited habeas data rights and definitions for personal and sensitive data, but primarily covers public-sector records. Multiple GDPR-inspired legislative proposals have been introduced in Congress in 2022-2025 and remain under debate without final approval.
Legal framework
Law on Access to Public Information, Decree 57-2008 (LAIP); no dedicated data protection law, multiple bills (Initiatives 6103, 6572, and a 2025 GDPR-modelled bill) pending in Congress
Key points: data & privacy in Guatemala
No comprehensive law
Guatemala has not enacted a general personal data protection statute as of May 2026, and no dedicated independent data protection authority exists. The overall regime is fragmented and sector-incomplete.
LAIP habeas data provisions
Decree 57-2008 (Ley de Acceso a la Información Pública) defines personal data and sensitive personal data (Art. 9) and grants a habeas data right (Art. 30) against public bodies and private entities receiving public funding, allowing individuals to access, correct, and delete their data.
Supervisory oversight
The Procurador de los Derechos Humanos (Human Rights Ombudsman) holds nominal oversight for habeas data matters under Article 46 of the LAIP; no specialized independent data protection authority has been created.
Active bills in Congress
Initiatives 6103 (Ley Integral de Protección de Datos) and 6572 are before Congress, alongside a 2025 GDPR-modelled bill introduced by deputy Nery Rodas; as of May 2026 none has completed the full legislative approval process.
Scope of proposed legislation
The leading proposed bills would apply to all data controllers (public and private) processing personal data in Guatemala, establish an independent supervisory authority with sanctioning powers, and enshrine rights of access, rectification, and erasure aligned with GDPR standards.
Constitutional privacy basis
Guatemala's 1985 Constitution (Article 24) establishes inviolability of correspondence and communications; the Constitutional Court has recognized derived privacy rights, providing the constitutional underpinning for data protection claims absent a dedicated statute.
Timeline of decisions
- DecisionAmCham Warns Investment Risk; Cybersecurity Committee Issues Favorable Opinion
The American Chamber of Commerce of Guatemala publicly warned that 17+ years without cybersecurity or data-protection legislation deters foreign investment and exposes citizens to data theft. Separately, a congressional commission issued a favorable opinion on Initiative 6347, the first cybersecurity bill to clear committee, advancing it toward plenary debate.
Infobae Guatemala
- IncidentDigecam Cyberattack Breaches Citizen Data, Spotlights Legislative Gap
A cyberattack on Guatemala's Directorate General of Civil Aeronautics (Digecam) compromised sensitive citizen records, prompting renewed calls for data-protection and cybersecurity legislation. The incident confirmed the real-world cost of the absence of criminal or regulatory data-security frameworks.
La Hora Guatemala
- Law · officialNew Personal Data Protection and Digital Rights Bill Filed
A fresh initiative was introduced in early 2025 proposing a framework data-protection law coupled with a digital rights guarantee, seeking to establish security guidelines for sensitive personal and organizational data. The bill adds to prior pending initiatives 6105 and 6572, none of which have reached a plenary vote.
Congreso de la República de Guatemala
- Law · officialInitiative 6572 Introduced: Personal Data Protection and Digital Rights Guarantees
A new comprehensive bill (Initiative 6572) was presented combining personal data protection with enforceable digital rights, proposing that citizens control who uses their data and establishing applicability to any public or private entity processing personal data in Guatemala — the broadest scope of any bill to date.
Congreso de la República de Guatemala
- Decision · officialParliamentary Forum on Digital Transformation Established
The Guatemalan Congress formally launched the Foro Parlamentario de Transformación Digital to build a legislative agenda covering digital governance, interoperability, cybersecurity, and data protection. This forum became the primary institutional vehicle coordinating the multiple pending data and cybersecurity bills.
Congreso de la República de Guatemala
- Decision · officialTransparency Commission Issues Favorable Opinion on Initiative 6105
The Congressional Transparency and Probity Commission issued a favorable opinion on Initiative 6105 (Personal Data Protection Law), returning it to the full plenary for three rounds of debate. This is the furthest any standalone data-protection bill has advanced in Guatemala's legislative history; it still awaits a plenary vote.
Congreso de la República de Guatemala
- Law · officialLaw on Access to Public Information (Decree 57-2008) Enters into Force, Creating Habeas Data Rights
Guatemala's Access to Public Information Law established the right of every individual to know, access, correct, and update personal data held in state files (habeas data) and designated the Ombudsman (Procurador de los Derechos Humanos) as the de facto national data protection authority — Guatemala's closest equivalent to a data-protection regime, in the continued absence of a dedicated privacy statute.
Gobierno de Guatemala — Decreto 57-2008 (official text)
- Law · officialDecree 57-2008: Law on Access to Public Information (LAIP) Enacted — Guatemala's Only Data Framework
LAIP, though a transparency statute, remains Guatemala's sole statutory personal-data protection regime: it enshrines habeas data rights, prohibits commercialisation of sensitive personal data, and recognises informational self-determination — a thin foundation that simultaneously underpins and exposes the critical governance vacuum that today's AI deployments operate within.
Comisión Presidencial GAE (gae.gob.gt)
- Law · officialDecree 57-2008 Enacted: Law on Access to Public Information (LAIP)
Congress enacted the Ley de Acceso a la Información Pública (LAIP), Guatemala's primary instrument for personal data held by the state. It classifies state-held personal data as confidential, grants citizens rights to access and correct their records in public databases, and designates the PDHI (Human Rights Ombudsman) as an oversight body — functioning as Guatemala's de facto partial data-protection statute for the public sector.
OAS / Congreso de la República de Guatemala
- Decision · officialConstitutional Court Establishes Habeas Data Doctrine (Expediente 1356-2006)
The Constitutional Court (CC) ruled in Expediente 1356-2006 that habeas data is a modality of the amparo constitutional action, establishing the only enforceable procedural mechanism for citizens to access, correct, or delete personal data from public and private databases. This ruling remains the cornerstone of data rights enforcement in the absence of dedicated legislation.
Corte de Constitucionalidad de Guatemala / OAS
- Law · official1985 Political Constitution: Foundational Privacy and Data Guarantees
Guatemala's Constitution embedded Articles 23 (inviolability of domicile), 24 (inviolability of correspondence, documents, and digital communications), 25 (registration of persons and vehicles), and 31 (right to access and correct personal data held in any state registry). These four articles remain the sole constitutional basis for all data privacy rights and underpin every subsequent ruling and draft bill.
OAS — Dirección de Derecho Internacional
Sources
- dlapiperdataprotection.com/index.html?t=law&c=GT
- dataguidance.com/notes/guatemala-data-protection-overview
- seccatid.gob.gt/sites/default/files/2025-05/16_laip_comentada-2011.pdf
- congreso.gob.gt/assets/uploads/info_legislativo/iniciativas/b2f76-6103.pdf
- congreso.gob.gt/noticias_congreso/13884/2025/1
- congreso.gob.gt/assets/uploads/info_legislativo/iniciativas/1c48c-6572.pdf
- neryrodas.com/2025/07/08/nery-rodas-presenta-iniciativa-de-ley-de-proteccion-de-dat
- iapp.org/news/b/data-protection-law-initiative-advances-in-guatemala
- oas.org/es/sla/ddi/proteccion_datos_personales_dn_guatemala.asp
- consortiumlegal.com/en/2022/11/02/questions-and-answers-on-data-protection-in-central-ame
- lexology.com/library/detail.aspx?g=3b54981e-5d9c-4c39-a643-0d1fea647198
Next for Guatemala: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026