Cybersecurity governance disputes stall Guatemala's digital security law

Guatemala is grappling with a cybersecurity governance vacuum, leaving it vulnerable to digital threats. Recent months have seen a string of high-profile cyberattacks, including data breaches at the Directorate General of Arms and Ammunition Control, the Ministry of Labor and Social Welfare's job portal, the University of San Carlos, the National Registry of Persons, and the Tax Administration Superintendency. These incidents highlight the urgent need for a comprehensive legal framework to address cybercrime.

“

We are in the phase of just fixing the governance of the law, which is actually what has kept us in a pleasant discussion.

Currently, Guatemala lacks specific laws to criminalize and prosecute cyber offenses. A proposed bill, initiative 6347, known as the Cybersecurity Law, was introduced in 2024 but remains stalled in a congressional commission. The delay stems from significant disagreements regarding the governance structure of the proposed national cybersecurity system. While consensus exists on the necessity of such legislation, the debate centers on defining the participating institutions and their operational roles.

“

The only issue we still have and on which we do not yet agree is governance, but we are rectifying it.

Discussions have been amicable but protracted, primarily focusing on the composition and authority of the governing body. Lawmakers are debating how to integrate state institutions, private sector entities, and other relevant actors into a coordinated system. A particularly sensitive point of contention is the inclusion of the Ministry of Defense, which some fear could lead to the militarization of cybersecurity efforts. Resolving these governance issues is crucial for moving forward with a law that can effectively protect Guatemala's digital infrastructure.

“

We have to create an entity that will have the governance of the law accompanied by other institutions, ministries, private initiative, and other sectors, because this cannot be a solo entity.