{"id":126907,"date":"2026-11-07T09:43:46","date_gmt":"2026-11-07T08:43:46","guid":{"rendered":"https:\/\/ceadigilaw.org\/?p=126907"},"modified":"2026-11-07T09:43:54","modified_gmt":"2026-11-07T08:43:54","slug":"guatemala-passes-cybersecurity-framework-law","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/pt\/blog\/guatemala-passes-cybersecurity-framework-law\/","title":{"rendered":"Guatemala passes its Cybersecurity Framework Law: 3 and 6 hour reporting"},"content":{"rendered":"<div lang=\"en\">\n<div class=\"cea-blog-resumen\">\n<p><strong>In brief<\/strong><\/p>\n<ul>\n<li>On 3 November 2026 Guatemala&#039;s Congress passed Decree 26-2026 (initiative 6347) as a matter of national urgency, with 121 votes in favour.<\/li>\n<li>The law creates Conciber, Diciber and the CRIC-GT, sets incident reporting at 3 hours (critical infrastructure) and 6 hours (other cases), and defines offences punishable by 2 to 8 years.<\/li>\n<li>It must still be published in the Diario de Centro Am\u00e9rica and will enter into force 30 days later; implementing regulations will follow.<\/li>\n<\/ul>\n<\/div>\n<p>On 3 November 2026 the Congress of Guatemala passed, as a matter of national urgency and with 121 votes in favour, <a href=\"https:\/\/www.congreso.gob.gt\/noticias_congreso\/17397\/2026\/4\" target=\"_blank\" rel=\"noopener\">Decree 26-2026, the Ley Marco de Ciberseguridad<\/a> (Cybersecurity Framework Law, initiative 6347). For the Euro-American Committee of Digital Law &#8211; CEA Digital Law it is a milestone: until now the country had no comprehensive law on the subject.<\/p>\n<h2>What the law creates<\/h2>\n<p>The text has 96 articles and combines administrative, criminal and procedural provisions. According to the <a href=\"https:\/\/dca.gob.gt\/noticias-guatemala-diario-centro-america\/nueva-ley-establece-penas-de-hasta-8-anos-por-hackeo\/\" target=\"_blank\" rel=\"noopener\">Diario de Centro Am\u00e9rica<\/a>, it provides for a Consejo Nacional de Ciberseguridad (Conciber) chaired by the President of the Republic, a Direcci\u00f3n Nacional de Ciberseguridad (Diciber) attached to the Ministerio de Gobernaci\u00f3n as the sector&#8217;s governing body, and a Centro de Respuesta a Incidentes de Ciberseguridad de Guatemala (CRIC-GT), which must be operational within 18 months.<\/p>\n<p>The Ministerio de la Defensa Nacional will have a cyberdefence unit separate from civilian functions. The law also foresees a specialised prosecution office, digital forensics, specialised courts and a 24\/7 cooperation network, according to <a href=\"https:\/\/www.infobae.com\/guatemala\/2026\/11\/04\/el-congreso-de-guatemala-aprueba-la-ley-marco-de-ciberseguridad-con-121-votos-y-crea-una-estructura-estatal\/\" target=\"_blank\" rel=\"noopener\">Infobae<\/a> and Publinews. It also adds cybersecurity content to the national school curriculum and sets up a technical working group with the public and private sectors, academia and civil society.<\/p>\n<h2>Reporting deadlines and safeguards<\/h2>\n<p>Incidents affecting critical infrastructure must be reported within three hours, others within six, and a full report within 72 hours. The CRIC-GT must anonymise reports and protect personal and institutional data. Information sharing may not include data protected by the Constitution or financial legislation without following legal procedures or obtaining a court order.<\/p>\n<p>On the criminal side, unauthorised access, interception, manipulation or deletion of data and attacks on platforms carry two to eight years in prison, with aggravated penalties for critical infrastructure or confidential data. Court orders to intervene in systems must specify the information sought, the equipment and the duration, and forensic copying is preferred over suspending systems. Where an intervention could affect critical financial services, the judge must seek technical advice from the Banco de Guatemala or the Superintendencia de Bancos, except in cases of serious and immediate risk.<\/p>\n<h2>Next steps<\/h2>\n<p>The law is passed but not yet in force: it must complete its legislative steps and be published in the Diario de Centro Am\u00e9rica. It will enter into force 30 days later, and the Ministerio de Gobernaci\u00f3n will then have six months to approve the regulations, according to <a href=\"https:\/\/tvaztecaguate.com\/nacionales\/2026\/11\/04\/nueva-ley-de-ciberseguridad-como-afectara-a-los-guatemaltecos\/\" target=\"_blank\" rel=\"noopener\">TV Azteca Guatemala<\/a>. The business federation CACIF backed modernisation but asked for technical adjustments and warned of possible constitutional challenges. Supporters link the reform to a future accession to the Budapest Convention.<\/p>\n<h2>Our view at CEA Digital Law<\/h2>\n<p>Deadlines of three and six hours are very demanding compared with Directive (EU) 2022\/2555 (NIS2), which provides for an early warning within 24 hours, a notification within 72 hours and a later final report. Guatemala shortens the first alert and keeps 72 hours for the detailed report. A short deadline only works if the recipient exists and is ready: the CRIC-GT has up to 18 months to become operational, so it should be made clear whom entities report to in the meantime.<\/p>\n<p>We suggest three priorities for the regulations: define objectively what counts as critical infrastructure and who designates it; allow an initial notice with minimal information, to be completed later, so that good-faith reporting is not penalised; and spell out the anonymisation and judicial oversight safeguards. Accession to the Budapest Convention, and attention to the concerns of the private sector and civil society about freedom of expression and constitutionality, would strengthen the law. Other countries in Latin America, the Caribbean and Africa still building their frameworks can learn from this case: separating civilian and defence functions and creating a multi-stakeholder working group are good practices, and their success will depend on resources, training and real coordination.<\/p>\n<h2>Sources<\/h2>\n<ul class=\"cea-blog-fuentes\">\n<li><a href=\"https:\/\/www.infobae.com\/guatemala\/2026\/11\/04\/el-congreso-de-guatemala-aprueba-la-ley-marco-de-ciberseguridad-con-121-votos-y-crea-una-estructura-estatal\/\" target=\"_blank\" rel=\"noopener\">Infobae<\/a><\/li>\n<li><a href=\"https:\/\/www.congreso.gob.gt\/noticias_congreso\/17397\/2026\/4\" target=\"_blank\" rel=\"noopener\">Congreso de la Rep\u00fablica de Guatemala<\/a><\/li>\n<li><a href=\"https:\/\/dca.gob.gt\/noticias-guatemala-diario-centro-america\/nueva-ley-establece-penas-de-hasta-8-anos-por-hackeo\/\" target=\"_blank\" rel=\"noopener\">Diario de Centro Am\u00e9rica<\/a><\/li>\n<li><a href=\"https:\/\/tvaztecaguate.com\/nacionales\/2026\/11\/04\/nueva-ley-de-ciberseguridad-como-afectara-a-los-guatemaltecos\/\" target=\"_blank\" rel=\"noopener\">TV Azteca Guatemala<\/a><\/li>\n<li><a href=\"https:\/\/www.publinews.gt\/noticias\/2026\/11\/04\/que-debes-saber-de-la-ley-marco-de-ciberseguridad-aprobada-en-el-congreso\/\" target=\"_blank\" rel=\"noopener\">Publinews<\/a><\/li>\n<\/ul>\n<p class=\"cea-blog-firma\"><em>CEA Digital Law<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Guatemala&#8217;s Congress passed Decree 26-2026: a new state structure, cybercrime offences and incident reporting deadlines of 3 and 6 hours.<\/p>\n","protected":false},"author":2,"featured_media":126910,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1118],"tags":[],"cea_women":[],"class_list":["post-126907","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ciberseguridad-pt"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/posts\/126907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/comments?post=126907"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/posts\/126907\/revisions"}],"predecessor-version":[{"id":126988,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/posts\/126907\/revisions\/126988"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/media\/126910"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/media?parent=126907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/categories?post=126907"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/tags?post=126907"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/pt\/wp-json\/wp\/v2\/cea_women?post=126907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}