Data protection & privacy law in Guatemala (2026)

The American Chamber of Commerce of Guatemala publicly warned that 17+ years without cybersecurity or data-protection legislation deters foreign investment and exposes citizens to data theft. Separately, a congressional commission issued a favorable opinion on Initiative 6347, the first cybersecurity bill to clear committee, advancing it toward plenary debate.

A cyberattack on Guatemala's Directorate General of Civil Aeronautics (Digecam) compromised sensitive citizen records, prompting renewed calls for data-protection and cybersecurity legislation. The incident confirmed the real-world cost of the absence of criminal or regulatory data-security frameworks.

Congress received Initiative 6771, proposing a National Cybersecurity System coordinating incident response across state institutions, adding to a backlog of eight pending cybercrime and data-security bills with none yet enacted. Guatemala's lack of criminal sanctions for data breaches leaves personal data processing entirely unregulated under criminal law.

A fresh initiative was introduced in early 2025 proposing a framework data-protection law coupled with a digital rights guarantee, seeking to establish security guidelines for sensitive personal and organizational data. The bill adds to prior pending initiatives 6105 and 6572, none of which have reached a plenary vote.

A new comprehensive bill (Initiative 6572) was presented combining personal data protection with enforceable digital rights, proposing that citizens control who uses their data and establishing applicability to any public or private entity processing personal data in Guatemala — the broadest scope of any bill to date.

The Guatemalan Congress formally launched the Foro Parlamentario de Transformación Digital to build a legislative agenda covering digital governance, interoperability, cybersecurity, and data protection. This forum became the primary institutional vehicle coordinating the multiple pending data and cybersecurity bills.

The Congressional Transparency and Probity Commission issued a favorable opinion on Initiative 6105 (Personal Data Protection Law), returning it to the full plenary for three rounds of debate. This is the furthest any standalone data-protection bill has advanced in Guatemala's legislative history; it still awaits a plenary vote.

With 112 votes, Congress voted to archive Decree 39-2022 weeks after passing it, following warnings from civil society and press organizations that its broad provisions on 'false information' would be weaponized against journalists. The reversal left Guatemala without any cybercrime or data-security criminal framework.

Congress approved Decree 39-2022 (Law on Prevention and Protection against Cybercrime), typifying crimes including illegal access, identity theft, computer fraud, and violations of personal data confidentiality — the first criminal sanctions for data offenses. The law was archived weeks later on civil-liberties grounds.

Congress enacted the Ley de Acceso a la Información Pública (LAIP), Guatemala's primary instrument for personal data held by the state. It classifies state-held personal data as confidential, grants citizens rights to access and correct their records in public databases, and designates the PDHI (Human Rights Ombudsman) as an oversight body — functioning as Guatemala's de facto partial data-protection statute for the public sector.

The Constitutional Court (CC) ruled in Expediente 1356-2006 that habeas data is a modality of the amparo constitutional action, establishing the only enforceable procedural mechanism for citizens to access, correct, or delete personal data from public and private databases. This ruling remains the cornerstone of data rights enforcement in the absence of dedicated legislation.

Guatemala's Constitution embedded Articles 23 (inviolability of domicile), 24 (inviolability of correspondence, documents, and digital communications), 25 (registration of persons and vehicles), and 31 (right to access and correct personal data held in any state registry). These four articles remain the sole constitutional basis for all data privacy rights and underpin every subsequent ruling and draft bill.