Standard summary · cert.gt
Ley de Acceso a la Información Pública (Access to Public Information Law)
Version 1.0 · Reviewed Oct 11, 2026 · TLP:CLEAR · For: Public entities and any organization that manages State funds or information.
The Ley de Acceso a la Información Pública (Access to Public Information Law, Decree 57-2008) guarantees every person's right to access information held by the State and, at the same time, protects the personal data that public entities keep. Guatemala does not have a general data protection law, so this is the main legal reference on personal data in the public sector.
Who is bound by it
- The branches of the State, municipalities, and autonomous and decentralized entities.
- Private entities that receive or manage public funds, with respect to those funds.
- The law calls all of them “sujetos obligados” (obligated parties).
Types of information
| Public | Everything held by the obligated parties. The general rule is maximum disclosure. |
|---|---|
| Public by default | Information that must be published without anyone asking for it: structure, budget, contracts, salaries, among other things. |
| Reserved | Information that is temporarily restricted on a ground provided for in the law and by means of a resolution. |
| Confidential | Information that is not handed over: personal data, sensitive data and secrets protected by other laws. |
Personal data and sensitive data
- Personal data: data relating to an identified or identifiable person.
- Sensitive data: data that touches on a person's private life, such as ethnic origin, health, beliefs, sex life, or financial or family situation.
- The obligated parties may not use the data for purposes other than those for which it was collected.
- They may not disclose or sell it without the express written consent of the data subject.
- They must adopt measures to protect the files and systems where it is kept.
Hábeas data
- Every person may find out which of their data appears in public files and what it is used for.
- They may ask for it to be corrected, updated or deleted.
- The entity must have a procedure for handling these requests.
How information is requested
- Each obligated party must have a Unidad de Información Pública (Public Information Unit) that receives and processes the requests.
- The request may be verbal, written or electronic, and you do not have to justify what you want the information for.
- The response deadline is ten days, which may be extended by another ten in justified cases.
- The Procuraduría de los Derechos Humanos (Human Rights Ombudsman's Office) is the regulatory authority for the law.
What it means for information security
- Classify information from the moment it is created: public, reserved or confidential.
- Before publishing a document, check that it does not contain personal or sensitive data; publish a version that leaves it out.
- Protect the databases that hold personal data: role-based access, encryption, query logs and backups.
- Have a procedure for responding when personal data is exposed by mistake.
- Train the staff of the Unidad de Información Pública in handling sensitive data.
Disclaimer
- This summary is for guidance and does not cite articles; it is not a substitute for reading the law or for legal advice.
- The law provides for administrative and criminal liability for non-compliance; check the text to learn what it is.
Official text
Decree 57-2008 of the Congreso de la República (Congress of the Republic). Check the text currently in force in the Diario de Centro América (the official gazette) or at congreso.gob.gt.