Biweekly briefing · No. 01 · November 9, 2026 · 17 min read

Decree 26-2026: what Guatemala's cybersecurity law protects, blurs and can still fix

Guatemala needed a cybersecurity law, and Decree 26-2026 brings real advances. But it places in a state security body functions that good practice keeps apart, leaves infractions to regulation and gives affected people no clear rights. We explain why that matters and what can still be corrected.
CollabPublished on

Share

  • Instagram does not allow sharing from the web: copy the link to paste it into your story or bio
Las ondas de Collab, la firma de la asociación, sobre añil con el punto achiote
In this publication
  1. What happened?
  2. Cybersecurity and cybercrime are not the same thing
  3. What the law says and where it contradicts itself
  4. What it does open
  5. The fallacies worth naming
  6. What we propose
  7. What we still don't know
  8. References

Source: Full references, in APA format, are at the end of the text; the decree is cited by its approved text, not yet published in the Diario de Centro América at the time of writing.

The idea in one sentence: Guatemala needed this law, but Decree 26-2026 treats two different jobs, protecting systems and prosecuting crimes, as a single problem, and leaves out the people who should be its reason for existing.

The official text of the decree (Congress of the Republic of Guatemala, 2026) has not yet been published. We distinguish what public sources confirm (with a citation), what those sources dispute among themselves and what rests only on our observations (Collab, 2026) or on the column by Marroquín (2026; our reading). An article inserted on the floor shifted the numbering: every number must be checked against the Diario de Centro América.

What happened?

On November 3, 2026, Congress approved Bill 6347 as Decree 26-2026.

The national-urgency motion received 109 votes in favor and 10 against (La Hora, 2026a), and the Organic Law of the Legislative Branch requires two-thirds of all deputies (Congress of the Republic of Guatemala, 1994, art. 113). The final text received 121 votes in favor and 10 against (Prensa Libre, 2026b), with 20 amendments and substitutions (Publinews, 2026). The Diario de Centro América (2026) counts 96 articles; Marroquín (2026), 97.

The bill was filed in 2024 (Congress of the Republic of Guatemala, 2024) and had a committee report in August 2025 (Congress of the Republic of Guatemala, 2025). What it did not have was debate over three sessions on the final text. Before the vote, CACIF, the private-sector umbrella group, had asked for technical amendments (La Hora, 2026a). At an August forum, the FUNDESA foundation argued that the country "needs it, and needs it soon," and that the question was the "technical quality" of its approval (Perspectiva, 2026).

The incidents behind the law are public: the Foreign Ministry in 2022 (Bloomberg Línea, 2022), DIGECAM, the arms registry (Prensa Libre, 2026a), and Labor Ministry data offered for sale in 2026 (Infobae, 2026a).

Cybersecurity and cybercrime are not the same thing

The idea first: looking after the house is one job, and investigating whoever broke in is another.

Cybersecurity protects systems. It manages risk, responds to incidents and restores services. It is governed by technical standards, such as the NIST Framework 2.0 (National Institute of Standards and Technology, 2024). It is carried out by incident response teams, known as CSIRTs, and by sector regulators. Its raw material is information that someone hands over early and without fear.

Cybercrime is criminal conduct. A prosecutor investigates it, under rules of evidence, judicial control and rights of defense. That is the territory of the Budapest Convention (Council of Europe, 2020). Its raw material is proof.

The two jobs cooperate, but their incentives run in opposite directions. The responder needs to be told everything; the investigator may use what was said against someone. That is why the EU's NIS2 Directive distinguishes competent authorities from CSIRTs (European Parliament and Council of the European Union, 2022, arts. 8 and 10).

The decree blends the two at four points, according to our reading of the approved text:

  • DICIBER, the new directorate under the Interior Ministry (Diario de Centro América, 2026), is a "state security body" (La Hora, 2026c); in our observations (Collab, 2026), it also supervises, investigates and sanctions.
  • In our observations (Collab, 2026), alongside resilience duties sits a protocol of offensive actions under the Defense Ministry.
  • The criminal exception covers authorized testing (Infobae, 2026b); in our reading it requires prior authorization, which leaves the independent good-faith researcher outside it.
  • In our reading, affected people have no channel of their own. According to Marroquín (2026), the national center must "inform in a timely manner" potential victims, with no deadline and no consequence.

What operating a reporting channel teaches

Anyone who designs anonymous reporting channels starts from one rule: people report only when they believe they cannot be identified, and a single leak destroys trust in the whole channel.

Five conditions make anonymity a property of the system:

  1. Anonymity by design: nobody asks for a name or contact details, and logs do not keep message text.
  2. Identity separated from the case: number or session never travels in the report.
  3. Clarity about who receives the report and what is kept.
  4. A code as acknowledgment on submission, and a check that the report reached whoever must act.
  5. Follow-up with that code, without promising deadlines or outcomes.

That practice also teaches counting in aggregate, by category, date and approximate place, suppressing small counts: built that way, a statistic holds no personal data.

And it teaches what to expect: fraud in online sales or loans, stolen accounts and extortion by phone, message or social media. The Public Prosecutor's Office reported in 2022 that among crimes through social networks and WhatsApp, fraud, threats and extortion led (DPL News, 2022). A law centered on systems leaves that victim without a window.

What the law says and where it contradicts itself

We set out by subject what is known of the decree and flag where the sources disagree.

Command (arts. 6-19). The National Council, with no budget of its own (La Hora, 2026c), is chaired by the President (Diario de Centro América, 2026) and made up of Executive officials (La Hora, 2026c); in our reading, the President "will make the decisions." Coherence: low, because several known attacks occurred within the Executive itself, and the one who must answer for them also supervises.

Lead agency (arts. 6-19). DICIBER has its own budget and a director appointed by the President from a shortlist proposed by the Council (La Hora, 2026c); in our observations (Collab, 2026), with no fixed term and no grounds for removal.

Consultation (arts. 6-19). The Technical Roundtable, coordinated by the director and meeting monthly (La Hora, 2026c), has members the Council authorizes; in our reading, it only advises.

Defense. Specialists quoted by La Hora (2026b) say the decree gives the Defense Ministry a power over classifying critical infrastructure without clarifying its scope; in our observations (Collab, 2026), it draws up the catalog. In Chile, the civilian agency makes that call (IAPP, n.d.). In our reading, the definition of cyberdefense includes "constitutional order" and "national interests," which are open concepts.

An earlier warning. A column by Juan Carlos Zapata (n.d.) on FUNDESA's site, about committee report 01-2025 and not this decree, already objected to the "predominance of a national security approach." In our reading, it still stands.

Sanctions (arts. 34 to 42). Infractions are left to regulation (La Hora, 2026c). Columnist Lisardo Bolaños (2026) adds that the defense has 2 days for a hearing and 5 for evidence and that the entity can keep the fines, and warns of the constitutional risk.

Crimes (arts. 43 to 55). The sources disagree on the ceiling: the Diario de Centro América (2026) gives up to 8 years for the core offenses and La Hora (2026c), 4 to 20 years across the range. Penalties rise by two-thirds (La Hora, 2026d) against critical digital infrastructure, and the decree repeals art. 274 A, B, E, F and G of the Criminal Code (La Hora, 2026c).

Alerts (art. 31). The sources disagree on the deadline for critical infrastructure: La Hora (2026c), Prensa Libre (2026c) and AGN (2026) give 30 minutes; Infobae (2026b) and another, updated La Hora piece (2026d), 3 hours. They agree on 6 hours for everything else and 72 for the full report. Both figures fall below the 24 hours in NIS2 (European Parliament and Council of the European Union, 2022, art. 23), though Chile requires an alert within 3 hours (AZ, n.d.). The main problem, in our reading, lies elsewhere: "significant" is not defined, and NIS2 does define it (European Parliament and Council of the European Union, 2022, art. 23.3).

Viability. In our observations (Collab, 2026), public entities "may" have response teams according to their budget, while the private sector faces sanctions. La Hora (2026c) gives 18 months for all implementation (art. 83); the Diario de Centro América (2026) applies that period only to CRIC-GT. The law takes effect 30 days after publication (Diario de Centro América, 2026).

What it does open

The decree also brings advances worth acknowledging.

  • A national framework, a response center and sector centers (La Hora, 2026c) where none exist today.
  • A possible step toward Budapest, which Guatemala was invited to join in 2020 (Council of Europe, 2020), with an extended deadline of March 2027 (Perspectiva, 2026), though specialists doubt it meets the Convention (La Hora, 2026b).
  • A Specialized Prosecutor's Office (Diario de Centro América, 2026) and a Permanent Attention Unit; one La Hora piece (2026c) places them in art. 73 and another (La Hora, 2026b) puts the prosecutor's office in 74.
  • Forensic copies instead of equipment seizure (Infobae, 2026b), and delimited searches (República, 2026).
  • Judicial control of data interruption (República, 2026), reviewable every 24 hours; according to Marroquín (2026), of interception too.
  • A technical report from the Bank of Guatemala or the SIB (Infobae, 2026b) before intervening in critical financial services, though Bolaños (2026) sees a gap in coordination with that supervision.
  • Cybersecurity content in the national base curriculum (La Hora, 2026a), a direct opportunity for education.

The fallacies worth naming

Six ideas in this debate deserve to be called by their name.

  • "More penalties, more security." Punishment arrives after the damage; it patches no server and trains nobody.
  • "Secrecy is protection." Reserving technical details protects. Reserving even the statistics only prevents evaluation.
  • "Defense is cybersecurity." Classifying a bank or a hospital is an economic and regulatory decision.
  • "National urgency is technical necessity." The urgency of the problem does not prove the quality of the solution.
  • "Prior authorization equals good faith." One can report a flaw in good faith without a contract, and hold one without it.
  • "Reporting everything is knowing everything." Without a threshold, the center receives noise.

What we propose

The articles cited follow our observations (Collab, 2026); their numbering is unconfirmed.

  1. Council (arts. 6-7). Decisions by majority, with voice and vote for essential-service operators, academia and civil society, elected by their sectors.
  2. Lead agency (arts. 10 and 13). A technical, civilian entity with functional autonomy, a director with a fixed term, listed grounds for removal and a public annual report to Congress.
  3. Technical Roundtable (art. 18). Membership set in the law and a duty on the Council to respond in writing.
  4. Defense. The catalog in the hands of the civilian lead agency with the banking, telecommunications and electricity regulators (SIB, SIT, CNEE). Offensive actions limited to national defense, defined in the law, with judicial control and a report to Congress.
  5. Cyberdefense (art. 5 d). Limit it to aggression by state or equivalent actors against national defense, and expressly exclude online expression, protest and political activity.
  6. Obligated parties and infractions (arts. 34 and 38). Only operators in the catalog are obligated; conduct and fine ranges written into the law.
  7. Fines and defense (arts. 28, 39 and 42). Fines to the general treasury, at least 10 days for a hearing and 15 for evidence, and separation of whoever investigates from whoever decides.
  8. Duties and alerts (arts. 29 and 31). Equal minimums for public and private entities. Define "significant incident" with impact criteria. Whatever period is published, alert in 24 hours, report in 72 and final report in 30 days, with NIS2 as the reference (European Parliament and Council of the European Union, 2022).
  9. People and transparency (arts. 9, 21 e and 43). Notify affected people within 72 hours, a stricter period than the "without undue delay" of the GDPR (European Parliament and Council of the European Union, 2016, art. 34). Publish annual statistics on incidents and interceptions. Create a coordinated vulnerability disclosure regime with no prior contract, drawing on Belgium (DLA Piper, 2023) and the 2022 US Department of Justice policy (Morrison Foerster, 2022): no intent to harm, proportionate and with immediate notice.

The law must also be tied to digital transformation and personal data protection laws. We also propose a public channel for victims, separate from whoever sanctions, with acknowledgment of receipt and aggregate figures.

What we still don't know

Five questions remain open as of this writing.

  • The exact text and its final numbering. It has not yet been published.
  • What the regulation will say, which the Interior Ministry would have six months to approve (Ceadigilaw, 2026).
  • Who receives reports while the national center does not exist.
  • What the 2027 budget will allocate.
  • How many incidents the State suffers. With no duty to publish, we may go on not knowing.

As Fernando Marroquín (2026) wrote in a column on November 4: "If your data leaks from a State system, this law obliges no one to tell you."

The decision will fall to the Executive: the Diario de Centro América (2026) says the decree now passes to it, and Prensa Libre (2026c) that style correction and deputies' objections come first. Under the Constitution, the President has 15 days from receipt of the decree to sign it or return it with observations (National Constituent Assembly, 1985, art. 178). The veto cannot be partial. If the decree is not returned, it is deemed signed. If it is returned, Congress may reconsider it or override the veto by two-thirds (National Constituent Assembly, 1985, art. 179). Weighing it is also up to you.

References

  • AGN. (2026). [Article on the approval of the Cybersecurity Framework Law]. https://agn.gt/?p=582266
  • AZ. (n.d.). Ley Marco de Ciberseguridad: claves del reglamento de reporte de incidentes [Cybersecurity Framework Law: Keys to the incident reporting regulation]. https://www.az.cl/ley-marco-de-ciberseguridad-claves-del-reglamento-de-reporte-de-incidentes/
  • Bloomberg Línea. (2022, October 7). Ciberataque al Minex deja como resultado filtración de datos sensibles [Cyberattack on the Foreign Ministry results in leak of sensitive data]. https://www.bloomberglinea.com/2022/10/07/ciberataque-al-minex-deja-como-resultado-filtracion-de-datos-sensibles/
  • Bolaños, L. (2026, November 5). Ciberseguridad: otra ley para vetar [Cybersecurity: Another law to veto] [Opinion column]. República. https://republica.com/columna-de-opinion/ciberseguridad-otra-ley-para-vetar-por-2026115900
  • Ceadigilaw. (2026, November). Guatemala passes cybersecurity framework law. https://ceadigilaw.org/en/blog/guatemala-passes-cybersecurity-framework-law/
  • Collab. (2026, November). Observaciones al Decreto 26-2026 [Observations on Decree 26-2026] [Internal document].
  • Congress of the Republic of Guatemala. (1994). Ley Orgánica del Organismo Legislativo [Organic Law of the Legislative Branch] (Decree 63-94). Universidad de San Carlos de Guatemala. https://investigaciones.derecho.usac.edu.gt/wp-content/uploads/2025/08/LEY-ORGANICA-DEL-ORGANISMO-LEGISLATIVO.pdf
  • Congress of the Republic of Guatemala. (2024). Iniciativa de ley 6347 [Bill 6347]. https://www.congreso.gob.gt/assets/uploads/info_legislativo/iniciativas/ea912-6347.pdf
  • Congress of the Republic of Guatemala. (2025, August 26). Dictamen de la iniciativa 6347 [Committee report on Bill 6347] [Copy published by Soy502]. Soy502. https://www.soy502.com/sites/default/files/dictamen_de_la_iniciativa_6347.pdf
  • Congress of the Republic of Guatemala. (2026). Decreto 26-2026, Ley Marco de Ciberseguridad [Decree 26-2026, Cybersecurity Framework Law] [Approved text, unpublished].
  • Council of Europe. (2020, April). Guatemala invited to accede to the Budapest Convention on Cybercrime. https://www.coe.int/en/web/cybercrime/-/guatemala-invited-to-accede-to-the-budapest-convention-on-cybercrime
  • Diario de Centro América. (2026, November 4). Nueva ley establece penas de hasta 8 años por hackeo [New law sets penalties of up to 8 years for hacking]. https://dca.gob.gt/noticias-guatemala-diario-centro-america/nueva-ley-establece-penas-de-hasta-8-anos-por-hackeo/
  • DLA Piper. (2023, June 21). Ethical hacking is now allowed under Belgian law. https://www.dlapiper.com/en-sk/insights/publications/2023/06/ethical-hacking-is-now-allowed-under-belgian-law
  • DPL News. (2022, August 18). Guatemala: van más de 3500 denuncias por delitos a través de redes sociales [Guatemala: More than 3,500 complaints of crimes through social networks so far]. https://dplnews.com/guatemala-van-mas-de-3500-denuncias-por-delitos-a-traves-de-redes-sociales/
  • European Parliament and Council of the European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). GDPR-Info. https://gdpr-info.eu/art-34-gdpr/
  • European Parliament and Council of the European Union. (2022). Directive (EU) 2022/2555 (NIS2 Directive). EUR-Lex. https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
  • IAPP. (n.d.). Algunas reflexiones sobre la Ley N.º 21.663, Marco de Ciberseguridad en Chile [Some reflections on Law No. 21.663, the Cybersecurity Framework in Chile]. https://iapp.org/news/a/algunas-reflexiones-sobre-la-ley-n-o-21-663-marco-de-ciberseguridad-en-chile
  • Infobae. (2026a, April 28). Un grupo de ciberdelincuentes pone a la venta datos robados del Ministerio de Trabajo de Guatemala [A group of cybercriminals offers for sale data stolen from Guatemala's Labor Ministry]. https://www.infobae.com/guatemala/2026/04/28/un-grupo-de-ciberdelincuentes-pone-a-la-venta-datos-robados-del-ministerio-de-trabajo-de-guatemala/
  • Infobae. (2026b, November 4). El Congreso de Guatemala aprueba la Ley Marco de Ciberseguridad con 121 votos y crea una estructura estatal [Guatemala's Congress approves the Cybersecurity Framework Law with 121 votes and creates a state structure]. https://www.infobae.com/guatemala/2026/11/04/el-congreso-de-guatemala-aprueba-la-ley-marco-de-ciberseguridad-con-121-votos-y-crea-una-estructura-estatal/
  • La Hora. (2026a, November 3). Congreso da luz verde y aprueba de urgencia nacional Ley Marco de Ciberseguridad [Congress gives the green light and approves the Cybersecurity Framework Law as a national urgency]. https://lahora.gt/nacionales/kmonzon/2026/11/03/congreso-da-luz-verde-y-aprueba-de-urgencia-nacional-ley-marco-de-ciberseguridad-now/
  • La Hora. (2026b, November 5). Ley de Ciberseguridad nace con cuestionamientos por vacíos legales y exclusión de delitos de pornografía infantil [Cybersecurity Law is born questioned over legal gaps and the exclusion of child pornography offenses]. https://lahora.gt/nacionales/la-hora/2026/11/05/ley-de-ciberseguridad-nace-con-cuestionamientos-por-vacios-legales-y-exclusion-de-delitos-de-pornografia-infantil/
  • La Hora. (2026c, November 6). Ley de Ciberseguridad: esta es la versión final con cambios del Decreto 26-2026 [Cybersecurity Law: This is the final version with the changes to Decree 26-2026]. https://lahora.gt/nacionales/dleon/2026/11/06/ley-de-ciberseguridad-esta-es-la-version-final-con-cambios-del-decreto-26-2026/
  • La Hora. (2026d, November 6). Ley de Ciberseguridad: estos son los delitos y penas que contempla y las instituciones que crea [Cybersecurity Law: These are the crimes and penalties it provides and the institutions it creates]. https://lahora.gt/nacionales/dguzman/2026/11/06/ley-de-ciberseguridad-estos-son-los-delitos-y-penas-que-contempla-y-las-instituciones-que-crea-now/
  • Marroquín, F. (2026, November 4). Guatemala: Una ley de ciberseguridad que no nos protege [Guatemala: A cybersecurity law that does not protect us] [Column]. Substack. https://fermarroquin.substack.com/p/guatemala-una-ley-de-ciberseguridad
  • Morrison Foerster. (2022). [Analysis of the US Department of Justice's cybercrime charging policy]. https://www.mofo.com/resources/insights/220525-cyber-crime-charging-policy
  • National Constituent Assembly. (1985). Constitución Política de la República de Guatemala [Political Constitution of the Republic of Guatemala]. Justia. https://guatemala.justia.com/nacionales/constitucion-de-la-republica-de-guatemala/titulo-iv/capitulo-ii/seccion-tercera
  • National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
  • Perspectiva. (2026, August 19). [Article on the FUNDESA forum on the cybersecurity law and the Budapest Convention]. https://perspectiva.gt/noticias/perspectivahoy/fundesa-foro-ciberseguridad-ley-convenio-budapest-guatemala-2026/
  • Prensa Libre. (2026a). Hackeo en la Digecam [Hacking at Digecam] [Topic page]. https://www.prensalibre.com/tema/hackeo-en-la-digecam/
  • Prensa Libre. (2026b, November 3). Congreso aprueba de urgencia nacional la ley de ciberseguridad con 121 votos [Congress approves the cybersecurity law as a national urgency with 121 votes]. https://www.prensalibre.com/ahora/guatemala/politica/congreso-aprueba-de-urgencia-nacional-la-ley-de-ciberseguridad-con-121-votos/
  • Prensa Libre. (2026c, November 4). Ley Marco de Ciberseguridad en Guatemala: qué delitos contempla, cuáles son las penas y cuándo entrará en vigor [Cybersecurity Framework Law in Guatemala: What crimes it covers, what the penalties are and when it takes effect]. https://www.prensalibre.com/guatemala/justicia/ley-marco-de-ciberseguridad-en-guatemala-que-delitos-contempla-cuales-son-las-penas-y-cuando-entrara-en-vigor/
  • Publinews. (2026, November 4). Qué debes saber de la Ley Marco de Ciberseguridad aprobada en el Congreso [What you should know about the Cybersecurity Framework Law approved in Congress]. https://www.publinews.gt/noticias/2026/11/04/que-debes-saber-de-la-ley-marco-de-ciberseguridad-aprobada-en-el-congreso/
  • República. (2026, November 3). Diputados aprueban de urgencia nacional la ley de ciberseguridad [Deputies approve the cybersecurity law as a national urgency]. https://republica.com/politica/diputados-aprueban-de-urgencia-nacional-la-ley-de-ciberseguridad-202611322360
  • Zapata, J. C. (n.d.). Ley de ciberseguridad debería regresar a la comisión [Cybersecurity law should return to committee] [Opinion column]. FUNDESA. https://fundesa.org.gt/publicaciones/columna-de-opinion/ley-de-ciberseguridad-deberia-regresar-a-la-comision

Share

  • Instagram does not allow sharing from the web: copy the link to paste it into your story or bio

Was this analysis useful?

Subscribe and get the next biweekly briefing in your inbox.