On November 3, 2026, the Guatemalan Congress approved Decree 26-2026, the Cybersecurity Framework Law, as a matter of national urgency. The law will take effect 30 days after its publication in the Official Gazette. Following that, the implementing regulations must be issued within six months of the law’s entry into force, along with the new Guatemalan Cybersecurity Incident Response Center (CRIC-GT) an institution that must be established and operational within 18 months.
The new law united efforts from various initiatives introduced since at least 2009 to address the needs arising from a process of digital transformation and innovation in Guatemala. In 2018, Guatemala’s government approved a National Cybersecurity Strategy as one of the first steps toward establishing cybersecurity objectives. This vision has continued, and in 2021, the National Cybersecurity Committee was created.
It is important to note that throughout 2026, various institutions in Guatemala have suffered cyberattacks that compromised their security to extract sensitive user information. This affected the General Directorate for Arms and Ammunition Control (Digecam) of the Ministry of Defense, the “Tu Empleo” platform of the Ministry of Labor (Mintrab), the University of San Carlos of Guatemala (USAC), Rafael Landívar University (URL), and the Ministry of Health (MSPAS), among others.
In light of the growing trend in cyber incidents, various sectors promoted this legislation as a priority in the areas of security and justice, empowering the State to collaborate with other governments to ensure prompt action and cooperation in the prosecution of crimes.
The New Law
The purpose of the Law is to create and develop the institutional framework for cybersecurity, establish an administrative penalty system, create a legal framework for criminal law and criminal procedure related to cybersecurity, and promote international cooperation and the strengthening of the technical capabilities necessary to address cybersecurity at the national level.
The scope of application covers the entire national territory, cyberspace, and other territorial and extraterritorial areas. In criminal matters, it will apply to any individual or legal entity, whether domestic or foreign, that commits an act classified as a crime in cyberspace, provided that the action originates, is ordered, or is carried out in Guatemala; has effects within the national territory; uses means located in the country; or involves any type of participation within Guatemalan territory.
The crimes covered by this Law are subject to public prosecution and are punishable by imprisonment and fines. They include unauthorized access, unlawful interception, attacks of computer data, attacks of computer systems, computer forgery, identity theft, computer fraud, misuse of devices, intellectual property crimes, copyright infringement, industrial property violations, and computer crimes.
Regarding investigations, the Law establishes a system of investigative procedures related to digital evidence, the evaluation of evidence, emergency procedures for data preservation, orders for access to and transmission of data, and digital preservation as interim relief. It also provides for the rapid preservation of cross-border data and the admissibility of digital evidence obtained abroad.
At the institutional level, the Law mandates the creation of a governing body, the National Cybersecurity Committee (Conciber), as well as agencies and response teams to support related technical and operational analyses. In addition, the Public Prosecutor's Office (MP) must establish a Specialized Prosecutor’s Office and a Mutual Assistance Network to serve as an international point of contact. Other entities, such as the National Institute of Forensic Sciences (Inacif), the National Civil Police (PNC), and the Institute of Public Criminal Defense (IDPP), must also participate in these efforts.
The Cybersecurity Framework Law is an important step in the government’s efforts to respond to the global rise in cybercrime, serving as a strategic pillar for addressing the growing demand for digital services and the challenges and opportunities that technology brings.
