🛡️ Guatemala passes its Cybersecurity Framework Law

Introduction

Guatemala now has, on paper, its first comprehensive cybersecurity law. Late on Tuesday, November 3, 2026, Congress fast-tracked the Cybersecurity Framework Law (Ley Marco de Ciberseguridad), enacted as Decree 26-2026, with 121 votes in favor and 10 against.

The 96-article law creates national institutions to prevent and respond to cyberattacks, defines computer crimes, sets out how digital evidence is gathered and assessed, and takes cybersecurity into the classroom. For companies and public bodies, it moves cybersecurity from "good practice" to a legal and corporate-governance matter.

Background: from bill to decree

Bill 6347 was introduced in February 2024 and received a favorable report from the National Security Affairs Committee in 2025. In April 2026, after reaching second reading, it went back to committee to refine inter-agency mechanisms; President Bernardo Arévalo warned at the time that public systems had been built without adequate protection and that "cyberspace has no geography".

That year, a string of attacks pushed the issue up the agenda: the breach at Digecam (the arms-control agency), the incident on the Labor Ministry's Tu Empleo platform, and attacks on the Constitutional Court, universities and other institutions. In October the committee issued a new report (01-2026) and the bill was renamed the Cybersecurity Framework Law as its scope grew to cover administrative, criminal, procedural, preventive and educational matters.

On November 3, a privileged motion won 109 votes (107 were needed) to handle it as a national urgency in a single debate. After approving the articles and amendments, the floor voted on the final text: 121 in favor, 10 against. Several lawmakers questioned the speed and asked for more time to review the amendments.

What the law sets up

• groupsNational Cybersecurity Council (Conciber): chaired by the President, with the ministers of the Interior, Foreign Affairs, Defense, Finance and Communications, plus the Secretary of Strategic Intelligence. It makes the strategic decisions.
• admin_panel_settingsNational Cybersecurity Directorate (Diciber): the technical and operational body under the Interior Ministry: policies, strategies, protocols and coordination of prevention and response.
• emergencyIncident Response Center (Cric-gt): handles and coordinates incident response nationwide. It must be operating within 18 months after the law takes effect.
• shield_lockSeparate cyber defense: the Defense Ministry will have a specialized unit, distinct from civilian cybersecurity.
• gavelComputer crimes: including illegal interception of data (5 to 8 years), attacks on data integrity (5 to 7) and on systems (5 to 8), identity theft (2 to 4, or 3 to 6 if security measures are breached) and misuse of devices (3 to 6). Penalties rise when critical infrastructure is affected.
• fact_checkDigital evidence and due process: searches of computer systems need a court order specifying which data, means, personnel and time frame; examining one device does not authorize access to other connected accounts. Before ordering a shutdown of critical financial services, a judge must first request a technical report from the central bank or the banking superintendency.
• policySpecialized investigation: a specialized prosecutor's office, the 24/7 Guatemala Network for international cooperation, a digital forensics unit at the national forensic institute (Inacif) and specialized courts.
• schoolEducation and participation: the Education Ministry will add cybersecurity to the national school curriculum, and a Technical Roundtable brings together the public and private sectors, academia and civil society.

What's still pending

• task_altPassed by Congress: November 3, 2026, under national-urgency procedure (Decree 26-2026).
• hourglass_topPresidential sanction: the President can sign it or return it with objections (veto).
• hourglass_topPublication in the Diario de Centro América: the effective-date period set by the decree starts from there.
• hourglass_topRegulations and rollout: Diciber, Cric-gt (up to 18 months), prosecutor's office and specialized units.

The final text, with the amendments approved on the floor, has not been published yet. Details such as exact incident-reporting deadlines or sector-specific obligations must be confirmed in the official version. The private sector, through CACIF, asked for technical amendments and warned that without them the law could face constitutional challenges, hinder accession to the Budapest Convention on cybercrime and clash with anti-money-laundering law.

What it means for Guatemala

First, it fills a gap. Until now the Criminal Code only partly covered some computer crimes, and the country had no national authority or response center with a legal mandate. The law gives a name, an owner and a procedure to something that was handled case by case.

Second, it connects Guatemala with the world. Attacks often come from abroad. The 24/7 Network and the digital-evidence rules are the basis for cooperating with other countries and service providers, and for eventually joining the Budapest Convention.

Third, it changes the boardroom conversation. An incident is no longer just a technical problem: it will sit within a criminal, procedural and administrative framework, with an authority to coordinate with. Banking, telecoms, energy, health, government and their suppliers will feel it first, but any company handling customer data should get ready.

And fourth, it doesn't solve everything. Guatemala still has no comprehensive personal data protection law, and success will depend on budget, specialized talent and clear regulations.

If you were hit by a cyberattack tomorrow, would your company know whom to call and what evidence to keep?

✅ Bonus: 6 steps to get your company ready

There's no need to wait for the regulations. These six steps are recognized good practice (ISO/IEC 27001, NIST CSF) and will leave you better placed whatever the final text says.

1. Name an ownerAppoint someone with authority and access to senior management for information security: an in-house CISO or a CISO as a Service. They'll be your natural link with the new authorities.
2. Identify what's criticalInventory your essential systems, data and services, and the suppliers behind them. If you serve critical sectors, expect more to be asked of you.
3. Update your incident response planDefine who decides, how issues escalate, whom you notify and how fast. Leave room for the reporting deadlines the official text sets.
4. Be ready to preserve evidenceEnable and retain access and system logs, synchronize clocks and document the chain of custody. No evidence, no investigation.
5. Review supplier contractsIT, cloud and software providers should commit to reporting incidents, cooperating with investigations and handing over logs when you need them.
6. Train and rehearseTrain staff on phishing, impersonation and fraud, and run at least one incident drill a year with senior management.

Pro tip

Frequently asked questions

Sources and fact-checking