Paraguay and Guatemala advance cyber laws

Paraguay and Guatemala are moving at different speeds on legislation covering cybersecurity, data protection and critical infrastructure. In Asuncion, Senator José Oviedo defended before the Senate floor a bill to protect critical infrastructure. The proposal was first introduced in December 2024 and later revised to identify, protect and strengthen the resilience of assets whose disruption could affect national security, the continuity of essential services, economic development and the well-being of the population. In Guatemala, initiative 6347 returned to committees in April 2026, while initiative 6771 had already been taken up by the full chamber on July 29, 2026.

What does the Paraguayan bill provide?

The Paraguayan bill seeks to identify and safeguard infrastructure whose disruption could affect key state and economic functions. It also brings in the National Defense Council for physical infrastructure and the Ministry of Information and Communication Technologies for technological infrastructure.

Paraguayan media reported that the measure was approved with amendments in committee and was among the items the Senate was set to review on September 23, 2026. ABC Color identified energy, water, telecommunications, health, transportation, finance and technology services as sectors covered by the bill. The text also says that any measures involving personal data processing must comply with current data protection law.

What is the status of the initiatives in Guatemala?

Initiative 6347, called the Cybersecurity Law, was introduced in 2024 and returned in April 2026 to the National Security Affairs and Economic and Foreign Trade committees. Initiative 6771, which proposes creating a National Cybersecurity System and punishing cybercrime, was taken up by the full chamber on July 29, 2026.

Prensa Libre reported, based on a warning from AmCham, that the lack of legislation is already affecting how investors assess Guatemala before operating there. Infobae added that the business group tied the regulatory delay to invisible attacks, data theft and uncertainty for new investment. The point confirmed in both accounts is the same, the legislative debate is still open and no law has been approved yet.

What is known about the Colombian bill cited in Gazette 1217?

An independent legal source that reproduces the congressional gazette identifies Gazette 1217 of 2026 as the document containing Statutory Bill 282 of 2026. The text provides for extraterritorial reach when processing affects data subjects located in Colombia or their data, and assigns functions to the Superintendence of Industry and Commerce and a specialized delegate prosecutor's office.