Guatemala, Mexico Push Cybersecurity Laws

Guatemala and Mexico are moving forward with cyber law proposals that would reshape governance, create new authorities and establish sanctions. In Guatemala, Initiative 6771 creates a National Cybersecurity System and gives the Ministry of the Interior authority over national policy, while in Mexico the debate over a Federal or General Cybersecurity Law is advancing in the Senate with its own institutional structure and penalty regime.

What changes in Guatemala under Initiative 6771?

In Guatemala, the analysis of Initiative 6771 prepared by the Digital Government Observatory says the proposal creates the National Cybersecurity System and, at the same time, assigns the Ministry of the Interior as the lead authority for national policy on the issue.

The planned framework also adds a National Cybersecurity Body as a technical office within that ministry. According to the document cited by the observatory, that body would be responsible for coordinating and carrying out strategies nationwide.

The proposal also adds a sanctions regime with fines of up to 2% of annual revenue for operators of essential services. It also incorporates specific cybercrime offenses into the Criminal Code.

What does the Mexican cybersecurity proposal set out?

In Mexico, the public discussion centers on a proposal identified as a Federal or General Cybersecurity Law, which is moving through the Senate.

The draft has 64 articles and aims to become the first Mexican federal law to comprehensively organize cybersecurity governance.

An independent technical analysis says the draft would create a National Cybersecurity Agency, a registry of critical infrastructure and a requirement for organizations to designate a cybersecurity officer. It also includes a sanctions regime with significant fines.

According to that same analysis, publication is expected during the second half of 2026.

The study adds that the future law would be linked to an existing strategic framework, because Mexico already has in force the General Policy of the National Cybersecurity Plan, published in the Official Gazette of the Federation in December 2025 by the Digital Transformation and Telecommunications Agency.

That places the legislative proposal in direct relation to a framework that already has official guidelines in operation, with compliance effects for companies that operate critical infrastructure or digital services.