Data protection & privacy law in Bolivia (2026)

Bolivia's Agency for Electronic Government (AGETIC) published an updated version of the draft Personal Data Protection Bill and an accompanying Manual de Protección de Datos on its official website, consolidating proposals for a national supervisory authority and full ARCO rights regime. The documents remain a pre-legislative instrument and have not yet been enacted.

The deadline imposed by Andean Community Decision 897 for Bolivia to transpose data-privacy guidelines into national legislation expired on 2 July 2024 without a law being enacted; Bolivia remains bound by the supranational obligation but users continue to lack a standalone enforcement framework. A draft law was still pending in Congress at that date.

AGETIC presented Bolivia's Anteproyecto de Ley de Protección de Datos Personales before the Andean Parliament, signalling the government's intent to comply with CAN Decision 897 and proposing an autonomous data-protection authority, data-subject rights, security standards, and rules for international transfers. This was the highest-profile official presentation of the bill to date.

A formal bill (reference PL-349, legislative session 2020-2021) on personal data protection was submitted to Bolivia's Chamber of Deputies for the first time as a dedicated standalone proposal, covering data-subject rights, a supervisory authority, and enforcement mechanisms. As of 2025, the bill remained pending in the Legislative Assembly without a vote.

Supreme Decree 1793 enacted sector-specific rules for ICT development under Law 164, including detailed personal data-protection obligations for ICT and telecom service providers and prohibitions on unsolicited commercial communications. It constitutes the most operationally specific data-protection regulation in force pending dedicated legislation.

Supreme Decree 1391 enacted the General Regulation to the 2011 Telecommunications Law, elaborating confidentiality and data-protection obligations for telecom operators and providers, operationalising the user-privacy articles of Law 164 for the first time in secondary legislation.

Law No. 164 established Bolivia's general framework for telecommunications and ICTs; Articles 56-57 required operators to guarantee the inviolability of communications and the protection of users' personal data and privacy, marking the first standalone statutory data-protection provisions in Bolivian law. It also created ADSIB as Bolivia's public digital-certification entity.

Bolivia's new Political Constitution came into force, establishing Article 21.2 (right to privacy and intimacy) and Articles 130-132 (Acción de Protección de Privacidad), a constitutional habeas data action that allows any person to access, contest, correct, or delete data held about them in public or private databases. These provisions form the constitutional bedrock for all subsequent data-protection efforts in Bolivia.

Law No. 1768 (promulgated 10 March 1997) modified the Bolivian Penal Code to insert Articles 363 Bis (Computer Manipulation, fraudulent alteration of data processing, 1-5 years imprisonment) and 363 Ter (Unlawful Alteration, Access, and Use of Computer Data), providing Bolivia's earliest criminal-law deterrent against misuse of personal data. These articles remain the principal criminal sanction in the absence of a comprehensive data-protection law.