Key Differentiators of the Law
Unlike Brazil and Ecuador, which have specific provisions on territorial application (and even extraterritorial reach in certain scenarios), El Salvador's new law does not include such provisions. It also lacks specific requirements for database registrations, unlike Nicaragua and Peru.
While the Law introduces the role of the data processor, it does not list specific duties or requirements for them, unlike Colombia and Costa Rica. It also omits the need for impact assessments, which are required by Uruguayan and Chilean laws.
Other unique aspects of El Salvador's new law include:
- Special emphasis on processing personal data of children, adolescents, and disadvantaged groups such as people with disabilities, the elderly, and indigenous populations.
- The requirement for a data protection officer, who plays a crucial role in managing privacy rights requests.
- In the event of security incidents, controllers must notify the supervisory authority, affected data subjects, and the Attorney General's Office.
All the above is structured around fundamental principles, including:
- Data Minimization: Collect only the data strictly necessary for the established purpose.
- Consent and Purpose: Ensure all data collection and processing have the explicit consent of the data subject and a clear, legitimate purpose.
- Lawfulness: Data processing must comply with current regulations and have a valid legal basis.
- Transparency: Inform data subjects clearly and accessibly about how their data will be used, avoiding technical jargon or fine print.
- Accuracy: Ensure data is precise, complete, and up to date to prevent errors that could affect data subjects.
- Security: Implement measures to protect data from unauthorized access, loss, or alterations.
New Supervisory Authority
The new supervisory authority responsible for enforcing the Law is the "State Cybersecurity Agency" (the "Agency"), established by Legislative Decree No. 143, the "Cybersecurity and Information Security Law." Both Decrees No. 143 and No. 144 were published in the same issue of the Official Gazette on November 15, 2024.
The Agency will be led by a Director General, who has yet to be appointed, and currently lacks an assigned budget. Once operational, the Agency must issue policies, measures, guidelines, and any other necessary provisions for the Law's implementation within three months of its effective date. Specific pending documents include policies for data controllers on personal data handling and security measures for data protection. Data controllers will have three months from the issuance of these provisions to comply.
The Law also sets a six-month deadline from its effective date to establish mechanisms for data subjects to exercise their rights.
Current National Context
The Law's enactment comes amid a positive national outlook. Real and encouraging facts and statistics about El Salvador can be found on the official website of the Investment and Export Promotion Agency – “Invest in El Salvador”, in the "Tourism Doing Business in El Salvador" report by UN Tourism and CAF dated November 15, 2024, and in the “2024 Investment Climate Statements: El Salvador” by the U.S. Department of State. The Law brings modernization, strengthens constitutional principles, and provides confidence and security to both local and foreign investors. An educational challenge now begins to ensure that citizens, government entities, and local and foreign companies understand and correctly apply the Law's content.
Article provided by INPLP member: Fabian Solis (Aguilar Castillo Love, Costa Rica) with the special collaboration of Flor de María Cortez and Bryan Guevara (Aguilar Castillo Love, El Salvador).
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
