Ley de Acceso a la Información Pública, Decreto 57-2008 (personal-data provisions)
Decreto Número 57-2008, Ley de Acceso a la Información Pública, arts. 9, 31-32, 61-67
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not disseminate, distribute, or commercialize personal data held in an information system without the data subject's express written consent.
- Never commercialize sensitive personal data (racial or ethnic origin, political ideology, religious belief, health, sexual life, or similarly intimate data) by any means.
- Before commercializing or distributing personal data or sensitive personal data that does not come from a public registry, obtain the titleholder's express written authorization.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 64 (commercializing personal data without authorization) and article 65 (unauthorized alteration or destruction of personal data on file) each carry five to eight years' imprisonment and a fine of fifty thousand to one hundred thousand quetzales, plus forfeiture of the instruments of the offense under article 64.
Penalty structure
Fine range under art. 64 (comercialización de datos personales); art. 65 (alteración o destrucción de información) carries the identical range. Both are companion to imprisonment of five to eight years.
- Rule
- Fixed only
- As of
- 5 September 2026
- Minimum
- 50,000
- Currency
- GTQ
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Procurador de los Derechos Humanos (Human Rights Ombudsman), the designated supervisory authority under this law; criminal prosecution proceeds through the ordinary Ministerio Público
What it reaches
Obligation class
Consent, Disclosure, Data subject rights
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Decreto 57-2008 is principally a freedom-of-information statute, but article 9 defines datos personales as any information concerning an identified or identifiable natural person and datos sensibles as data touching a person's racial or ethnic origin, political ideology, religious belief, health, sexual life, or other intimate matters.
Article 31 bars an obligated entity from disseminating, distributing, or commercializing personal data held in its information systems without the data subject's express written consent, and expressly and absolutely prohibits commercializing sensitive data by any means.
Article 32 lists narrow exceptions to the consent requirement, including statistical, scientific, or general-interest purposes where the data cannot be linked back to the individual, and transmission between obligated public entities for the exercise of their duties.
Article 64 makes it a crime, punishable by five to eight years' imprisonment and a fine of fifty thousand to one hundred thousand quetzales, for anyone to commercialize or distribute personal data or sensitive personal data protected by the law without the titleholder's express written authorization, where the data does not come from public registries, without prejudice to civil liability for resulting damages.
Article 65 similarly punishes unauthorized alteration or destruction of personal data held in a public institution's files or electronic records with the same penalty range.
When LexLint raises it
high_risk_decisionsautomated_outreach