Processes personal data, in Guatemala

Decreto Número 57-2008, Ley de Acceso a la Información Pública, arts. 9, 31-32, 61-67 · Read the law's page

• Do not disseminate, distribute, or commercialize personal data held in an information system without the data subject's express written consent.
• Never commercialize sensitive personal data (racial or ethnic origin, political ideology, religious belief, health, sexual life, or similarly intimate data) by any means.
• Before commercializing or distributing personal data or sensitive personal data that does not come from a public registry, obtain the titleholder's express written authorization.

Ley de Acceso a la Información Pública, Decreto Número 57-2008, arts. 30 and 33-35 (hábeas data) · Read the law's page

• Adopt procedures to receive and answer requests from data subjects or their legal representatives for access to and correction of personal data, and train staff and publish the entity's policies on protecting that data.
• Hold personal data only where it is adequate, relevant and not excessive for the purposes for which it was obtained.
• From the moment personal data is collected, give the individual the document stating the purposes of its processing.
• Keep personal data accurate and up to date, and take the measures needed to keep it secure and, where applicable, confidential, and to prevent its alteration, loss, transmission and unauthorized access.
• Deliver the personal data held on a requester, after identification, within ten working days, in a format the requester can understand, or tell the requester in writing that the system holds none on them.
• Answer a request to modify personal data within thirty working days with a resolution recording the changes or the reasons they were refused.

Iniciativa de Ley 6105, Ley de Protección de Datos · Read the law's page

• Any natural or legal person, public or private, that processes personal data must comply with the ARCO rights framework and the bill's registration, consent, and security duties.