Bolivia

Bolivia has no comprehensive data-protection statute.

The constitutional habeas data action (CPE art. 130) lets any person compel a public or private data holder to disclose, rectify, or delete personal data affecting their privacy, image, honour, or reputation, and Ley No. 164 of 2011 places a narrower duty of communications secrecy and personal-data protection on telecommunications and ICT service providers, developed in more detail by the personal-data chapter of Decreto Supremo No. 1793 of 2013's implementing regulation.

Ley No. 1080 (Ley de Ciudadanía Digital), art. 12, separately binds public servants operating Bolivia's e-government interoperability platform to use the personal data it generates only for purposes established by law, a narrower government-sector duty distinct from the general regime.

AGETIC, the e-government agency, has circulated a comprehensive draft Anteproyecto de Ley de Protección de Datos Personales since at least 2018, most recently in April 2024, which as of 2026 had not been submitted to the Asamblea Legislativa Plurinacional for a floor vote and so imposes no binding obligations yet.

Bolivia has no scraping-specific statute, so general law governs each dimension separately.

The Código Penal's computer-crime articles, added by Ley No. 1768 of 1997, are the closest fit for unauthorized access: article 363 ter criminalizes appropriating, accessing, using, modifying, suppressing, or disabling data stored on a computer or other computer medium without authorization, causing harm to the data's owner, and article 363 bis separately criminalizes manipulating a data processing or transfer for undue financial benefit.

Ley No. 1005, Código del Sistema Penal, purported to abrogate Ley 1768 when it was promulgated on 15 December 2017, but its own transitory provisions deferred entry into force of the Code's rules, including that abrogation, for eighteen months, and Ley No. 1027 abrogated the Código del Sistema Penal in its entirety on 25 January 2018, well within that period, so articles 363 bis and 363 ter were never displaced.

No Bolivian statute or reported case addresses the enforceability of a browsewrap or clickwrap terms-of-service against a scraper, and none establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, or assigns legal weight to a robots.txt directive. Bolivia's copyright statute, Ley No. 1322 of 1992, has no sui generis database right and no text-and-data-mining exception (see the aggregation-topic document for its quotation exception, art. 24).

Personal-data law reaching scraped personal data sits with the general habeas data action and the telecommunications and ICT-sector duties researched under the privacy topic, rather than in a scraping-specific personal-data provision.

Bolivia has no enacted statute or regulation setting product-security requirements, a vulnerability or incident-reporting duty, a sector cyber-resilience regime, or a general reasonable-security baseline that binds a private business with no sector gate. The nearest candidates each fail on inspection.

The Reglamento para el Desarrollo de las Tecnologías de Información y Comunicación (Decreto Supremo No. 1793, 2013) devotes a chapter, Título V Capítulo II (Tratamiento de los datos personales), to personal-data processing, and its Article 56 requires the person responsible for processing personal data, in either the public or the private sector, to adopt the technical and organizational measures needed to guarantee the security of that data and prevent its alteration, loss or unauthorized processing.

That article is one section of the only general personal-data-treatment framework Bolivia has today, the same shape General Data Protection Regulation (GDPR) Article 32 has inside the GDPR, so it is Test 2 in the security-privacy seam determination and stays on this jurisdiction's privacy row rather than being restated here.

The same Reglamento's other security-flavored provisions, Articles 5, 7 and 8, direct only entidades públicas (public entities) to pursue seguridad informática through software-sovereignty principles and contingency plans, so even read apart from the data-protection chapter they impose no duty on a private business.

Bolivia's Agencia de Gobierno Electrónico y Tecnologías de Información y Comunicación (AGETIC), created to implement Ley No. 164 Article 74's e-government mandate, runs a Centro de Gestión de Incidentes Informáticos and publishes public cybersecurity-awareness content (Ciberconsejos), but every page of its own site reachable through the crawler infrastructure frames that work as government-facing rather than as a legal duty running to a private operator, consistent with its founding e-government mandate; no provision found imposes a reporting or compliance duty on a private company.

AGETIC's own 2024/2025 Anteproyecto de Ley de Protección de Datos Personales, a comprehensive draft bill still at the anteproyecto (pre-legislative) stage with no evidence found of introduction before the Asamblea Legislativa, likewise carries its own security chapter (a proposed Título/Capítulo styled Régimen de seguridad, requiring physical, technical and administrative measures to prevent unauthorized alteration, loss, use or access to personal data), the same Test 2 shape as the enacted Reglamento's Article 56, so it belongs to this jurisdiction's privacy row as a proposed instrument rather than to this one.

Ley General de Telecomunicaciones (Ley No. 164, 2011) was read in full for a private-sector security duty: its uses of seguridad concern the security and defense of the state, spectrum management, and an operator's duty to cooperate with authorities during a declared emergency (Articles 8, 11, 54, 60, 64, 72, 111), not a vulnerability-handling, incident-reporting or product-security duty running to a telecommunications operator, an internet service provider or a software developer; Article 56's inviolabilidad y secreto de las comunicaciones provision is this jurisdiction's privacy-topic finding and is not restated here.

No standalone cybersecurity law, critical-information-infrastructure statute or national CERT-empowering statute reaching a private business was found; a Ley de Ciberseguridad Boliviana, if one is being drafted, was not located through any source reached here.

The Autoridad de Supervisión del Sistema Financiero (ASFI) Regulation on information-security management binds the financial institutions it supervises, sector-gated rather than general, and its security and annual vulnerability-report duties are filed as rows of their own.

Both www.asfi.gob.bo and a candidate normativa page returned only a JavaScript navigation shell or a 404 at the crawler's full tier and its automatic browser-tier retry, and this session's WebSearch budget was exhausted before this jurisdiction's visit began, so the question is recorded as unreached rather than answered; it should not be read as a confirmed absence.

The Código Penal's Manipulación Informática and Daño Informático offenses, and the Constitución Política del Estado's Acción de Protección de Privacidad, are this jurisdiction's scraping-topic and privacy-topic findings respectively and are not restated here.

The Reglamento para la Gestión de Seguridad de la Información in the Recopilación de Normas para Servicios Financieros of the Autoridad de Supervisión del Sistema Financiero sets minimum directives and requirements for information security management and is filed as a row of its own.

Section 12 of that Reglamento requires a supervised entity to send the Autoridad de Supervisión del Sistema Financiero the result of its vulnerability analysis by 15 November each year, and that duty is filed as a row of its own.

Bolivia has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question. Ley No. 1322 of 13 April 1992, sobre el Derecho de Autor, is the only relevant instrument.

Its Título VI, on limitations to copyright, does not exclude the news of the day or mere facts from protection, and it has no dedicated press-summary exception; its article 24 permits quoting an author generally, including short fragments of others' already-divulged works, for citation, analysis, commentary, or critical judgment, for teaching or research purposes, in accordance with honest practices and to the extent the purpose justifies, without becoming abusive.

Whether that quotation exception reaches a systematic news aggregator's reproduction of headlines and snippets, as opposed to a person quoting for the teaching or research purposes the article names, has not been tested in a reported Bolivian decision. The Law predates the concept of a machine-readable text-and-data-mining reservation and confers no sui generis database right, so no opt-out mechanism or database right exists either.