{"id":127454,"date":"2026-11-12T09:41:43","date_gmt":"2026-11-12T08:41:43","guid":{"rendered":"https:\/\/ceadigilaw.org\/?p=127454"},"modified":"2026-11-12T09:41:50","modified_gmt":"2026-11-12T08:41:50","slug":"guatemala-cybersecurity-framework-law-deadlines","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/fr\/blog\/guatemala-cybersecurity-framework-law-deadlines\/","title":{"rendered":"Guatemala passes a Cybersecurity Framework Law with response deadlines"},"content":{"rendered":"<div lang=\"en\">\n<div class=\"cea-blog-resumen\">\n<p><strong>In brief<\/strong><\/p>\n<ul>\n<li>Guatemala&#039;s Congress has approved the Ley Marco de Ciberseguridad, creating a National Cybersecurity Council and a National Cybersecurity Directorate.<\/li>\n<li>It sets mandatory incident deadlines (30 minutes, 6 hours and 72 hours) and defines eight offences punishable by 2 to 12 years in prison.<\/li>\n<li>It enters into force 30 days after publication, with implementing rules due six months later: implementation is the real test.<\/li>\n<\/ul>\n<\/div>\n<p>Guatemala&rsquo;s Congress (Congreso de la Rep\u00fablica de Guatemala) has approved the Ley Marco de Ciberseguridad, as <a href=\"https:\/\/dplnews.com\/congreso-guatemala-aprueba-ley-ciberseguridad\/\" target=\"_blank\" rel=\"noopener\">reported by DPL News on 9 November 2026<\/a>. It matters because it brings mandatory incident-response deadlines and an institutional structure the country did not previously have.<\/p>\n<h2>What Congress has approved<\/h2>\n<p>The decree follows a series of attacks on public bodies: the Ministry of Foreign Affairs in 2022, the Ministry of Public Finance in 2023, the Ministry of Education in 2024 and, in 2026, the Direcci\u00f3n General de Control de Armas y Municiones and the Tu Empleo platform.<\/p>\n<p>The law creates the Consejo Nacional de Ciberseguridad, a strategic body chaired by the President of the Republic and made up of ministers and security and intelligence heads. The Direcci\u00f3n Nacional de Ciberseguridad, under the Ministerio de Gobernaci\u00f3n, will be the lead technical and operational authority. A Red 24\/7 Guatemala will provide a permanent channel for international alerts and investigations.<\/p>\n<h2>Deadlines and offences<\/h2>\n<p>The response deadlines are the most striking feature: 30 minutes where critical infrastructure is compromised, six hours for general emergencies and 72 hours to deliver a full assessment of the incident.<\/p>\n<p>On the criminal side, the law punishes eight conduct types committed in digital environments, with prison terms of 2 to 12 years and aggravating factors such as attacks on critical infrastructure. Unlawful access and interception carry four to eight years, and attacks on data and systems five to eight years. The Ministerio P\u00fablico will have a specialised prosecutor&rsquo;s office, dedicated courts and a digital forensics unit at the Instituto Nacional de Ciencias Forenses de Guatemala.<\/p>\n<h2>Timetable and prevention<\/h2>\n<p>The law will enter into force 30 days after publication in the <em>Diario de Centro Am\u00e9rica<\/em>, and the Ministerio de Gobernaci\u00f3n will have six months from that date to issue the operating regulations. Until then, parliamentary approval is not the same as effective application. The law also provides for cybersecurity to be added to the Curr\u00edculo Nacional Base in schools and for a Technical Panel bringing together the public, private, academic and civil society sectors.<\/p>\n<h2>Our view at CEA Digital Law<\/h2>\n<p>We welcome Guatemala&rsquo;s decision to give cybersecurity a legal framework, institutions and investigative capacity, together with international cooperation and school education. It is a solid base to build on.<\/p>\n<p>In comparative terms, the European NIS2 Directive provides for an early warning within 24 hours and a notification within 72 hours, followed by a final report, and differentiates by type of entity. A 30-minute deadline for critical infrastructure is very demanding: to be workable it will need clear definitions of critical infrastructure, of what counts as an incident and of who notifies whom, plus technical channels available around the clock.<\/p>\n<p>We suggest the regulations, to be drafted by the Ministerio de Gobernaci\u00f3n, address three points: proportionality for smaller operators, protection of personal data in notifications, and safeguards for technical independence, given that the Council will be chaired by the executive. The multi-sector Technical Panel could be the right forum. Other countries in Latin America and the Caribbean and in Africa preparing similar laws will watch this implementation phase with interest.<\/p>\n<p>This note was prepared by the Euro-American Committee of Digital Law &#8211; CEA Digital Law.<\/p>\n<h2>Sources<\/h2>\n<ul class=\"cea-blog-fuentes\">\n<li><a href=\"https:\/\/dplnews.com\/congreso-guatemala-aprueba-ley-ciberseguridad\/\" target=\"_blank\" rel=\"noopener\">DPL News: Congreso de Guatemala aprueba ley de ciberseguridad con plazos de respuesta ante ataques<\/a><\/li>\n<\/ul>\n<p class=\"cea-blog-firma\"><em>CEA Digital Law<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Guatemala&rsquo;s Congress has passed a Cybersecurity Framework Law: new bodies, eight offences and incident deadlines of 30 minutes, 6 hours and 72 hours.<\/p>\n","protected":false},"author":2,"featured_media":127456,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1119],"tags":[],"cea_women":[],"class_list":["post-127454","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ciberseguridad-fr"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/127454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/comments?post=127454"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/127454\/revisions"}],"predecessor-version":[{"id":127474,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/127454\/revisions\/127474"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media\/127456"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media?parent=127454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/categories?post=127454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/tags?post=127454"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/cea_women?post=127454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}