Cybersecurity regulation in Bolivia (2026)

Bolivia enacted DS 5468 to update its Electronic Government Plan through 2028, adding a dedicated cybersecurity and incident-management pillar alongside digital sovereignty and interoperability objectives; all Executive Branch entities must align their institutional security plans with CGII guidelines.

President Luis Arce signed Bolivia's Agenda Digital 2030, a medium-term public policy instrument managed by AGETIC; cybersecurity and incident management are among its five strategic pillars, binding the Executive Branch to prioritise secure, sovereign digital infrastructure through 2030.

Bolivia failed to enact domestic legislation by the two-year deadline set by Andean Community Decision 897; because the decision has supra-national legal force above domestic law, the lapse left Bolivian telecoms users without the enforceable personal-data, security, and network-neutrality protections the framework requires.

LockBit ransomware actors compromised AXS Bolivia, a web-hosting and internet-services provider, exfiltrating customer data; the incident exposed the absence of mandatory private-sector cybersecurity obligations in Bolivia's legal framework.

AGETIC circulated Bolivia's first serious draft Personal Data Protection Bill, aimed at closing the Andean Community compliance gap and establishing an independent supervisory authority; as of 2025 the bill had not been enacted by the legislature.

DS 3251 approved Bolivia's first formal Electronic Government Plan and mandatory Free/Open-Source Software Policy, providing the strategic framework under which AGETIC coordinates public-sector digital security standards and e-government services across all ministries.

The most significant cybersecurity governance milestone: DS 2514 created AGETIC as the central e-government authority and established the CGII as Bolivia's national CSIRT; it mandated every public entity to maintain an Institutional Information Security Plan and report incidents to CGII within 24 hours of discovery.

DS 1793 issued the operational regulation for Law 164, governing digital certification authorities, electronic signatures, e-government services, and mandatory use of free software in public administration — establishing the technical-legal backbone for state cybersecurity practices.

Law 164 is the foundational statute for Bolivia's digital regulation: it established the legal basis for e-commerce, electronic signatures, and digital communications, and introduced cybercrime offences into the Penal Code (Arts. 179 bis, 363 bis, 363 ter) covering unauthorised access, data manipulation, and ICT sabotage.

Bolivia's new Political Constitution expressly recognised the right to privacy and intimacy, inviolability of communications, and informational self-determination (habeas data action), providing the constitutional foundation upon which all subsequent cybersecurity and data-protection obligations rest.