Cybersecurity regulation in Guatemala (2026)

The Congressional Commission on National Security Affairs issued a favourable opinion on Initiative 6347 after 18 months of analysis, clearing it for full plenary debate. The bill typifies eight new cyber offences, establishes CSIRT-GT as a national incident-response centre, and aligns Guatemala with the Budapest Convention framework.

The Ministry of Governance organised Guatemala's inaugural multi-institution cyber defence tabletop exercise to test inter-agency coordination for major cyber incidents, reflecting growing institutional capacity building supported by the OAS and UNODC.

Deputies from the CREO caucus submitted Initiative 6347, Guatemala's first comprehensive cybersecurity bill, proposing codified cyber offences, a formal legal framework for digital security obligations, and the statutory creation of a national CSIRT-GT under the National Security Council.

Hacktivists affiliated with Anonymous took down numerous Guatemalan government webpages for several days via distributed denial-of-service attacks in solidarity with indigenous-led pro-democracy protests; the incident exposed institutional gaps in cyber resilience with no dedicated cybercrime law in force.

Just 20 days after passing it, Congress voted 112-to-archive Decree 39-2022 following mass protests from journalists, civil-society organisations, and human rights groups who argued it criminalised free expression and enabled state censorship; Guatemala was left again without a dedicated cybercrime statute.

With 100 votes in favour, the Guatemalan Congress approved the Law on Prevention and Protection against Cybercrime — the country's first standalone cybercrime statute — creating criminal sanctions for unauthorised system access, data breaches, and malware distribution; it never entered into force.

The regional hacktivist group Guacamaya breached Compañía Guatemalteca de Níquel (CGN), leaking documents alleging police payments to suppress anti-mining activists in El Estor; the incident was the opening strike of a broader Latin American campaign exposing government-corporate cyber vulnerabilities.

The Executive created CONCIBER via Government Agreement 200-2021, formalising an advisory body to the National Security Council tasked with overseeing implementation of the National Cybersecurity Strategy; the committee held a four-year mandate running to late 2025.

The Ministry of Governance officially launched Guatemala's National Cybersecurity Strategy, structured around four pillars — legal frameworks, technical capabilities, education and culture, and international cooperation — and calling for the creation of a national CSIRT-GT in alignment with the OAS AG/RES. 2004 inter-American cybersecurity mandate.

Congress enacted the Law for the Recognition of Electronic Communications and Electronic Signatures, establishing the legal validity and security requirements for digital transactions and e-signatures; it became the foundational instrument for digital-economy cybersecurity obligations and was supplemented by Acuerdo Gubernativo 135-2009.