DLA Piper Intelligence

Data Protection
Laws of the World

Law

El Salvador
El Salvador

N/A. 

El Salvador’s Congress approved a Personal Data Protection Act on Apr. 22, 2021. As part of the process of creation of a Law in El Salvador, all Acts approved by Congress are later referred to the President of the Republic for his review/veto/approval. In this case, the Act was vetoed and sent back to Congress for review but no further action has been taken in order to review the causes for the veto and/or make any amendments for its further approval. 

Hence, data protection regulation in El Salvador remains disseminated in many other Acts that briefly regulate the confidentiality of a person’s information but no specific regulation is in place.

Last modified 28 Jan 2024
Law
El Salvador

N/A. 

El Salvador’s Congress approved a Personal Data Protection Act on Apr. 22, 2021. As part of the process of creation of a Law in El Salvador, all Acts approved by Congress are later referred to the President of the Republic for his review/veto/approval. In this case, the Act was vetoed and sent back to Congress for review but no further action has been taken in order to review the causes for the veto and/or make any amendments for its further approval. 

Hence, data protection regulation in El Salvador remains disseminated in many other Acts that briefly regulate the confidentiality of a person’s information but no specific regulation is in place.

Last modified 28 Jan 2024
Definitions

Definition of Personal Data

“Information concerning a natural/moral person who is identified or identifiable.” 

Definition as contained Personal Data Protection Act on Apr. 22, 2021

Definition of Sensitive Personal Data

“Personal data that affects the most intimate sphere of its owner and whose misuse may give rise to discrimination, seriously affect the right to honour, personal and family privacy and self-image. They are generally those that reveal aspects such as creed, religion, ethnic origin, political affiliation or ideologies, union membership, sexual preferences, physical and mental health, biometric information, genetics, moral and family situation, and other intimate information of a similar nature.” 

Definition as contained Personal Data Protection Act on Apr. 22, 2021

Last modified 28 Jan 2024
Authority

The Personal Data Protection Act on Apr. 22, 2021 created the National Authority for the Protection of Personal Data; however, said institution is not in force given that the Act was not finally approved. 

Some protection of data is handled by the Institution of Access to Public Information but in regards specifically to data of persons who have had a direct relationship with the Government, such as current or former public employees, contractors, etc.

Last modified 28 Jan 2024
Registration

Registration is not regulated.

Last modified 28 Jan 2024
Data Protection Officers

To this date, only Public Offices/Institutions are required to appoint a Public Information Access Officer, but no Data Protection Officer regulation is in place.

Last modified 28 Jan 2024
Collection & Processing

Collecting and Processing is not specifically regulated. However, the E-Commerce Act establishes, in general terms, that all information provided by the user of an online store/marketplace must be safely guarded. Similar requirements are established by the E-Signature Act, in regards to the information of the owners of an E-Signature.

Last modified 28 Jan 2024
Transfer

Transfer is not specifically regulated. However, disperse regulation generally establishes that the owner of personal information must authorise in written the transfer of their data.

Last modified 28 Jan 2024
Security

Security is not specifically regulated. However, the E-Commerce Act establishes, in general terms, that all information provided by the user of an online store/marketplace must be safely guarded. Similar requirements are established by the E-Signature Act, in regards to the information of the owners of an E-Signature.

Last modified 28 Jan 2024
Breach Notification

Breach notification is not regulated.

Last modified 28 Jan 2024
Enforcement

No specific Enforcement Authority has been created. However to the extent of its capabilities and within the legal framework of our criminal jurisdiction, the General Attorney’s Office can prosecute any crime related with the use of personal data as regulated in the laws of the matter.

Last modified 28 Jan 2024
Electronic Marketing

Electronic Marketing is not specifically regulated; however, false/misleading advertisement is punishable as stated in El Salvador’s Consumer Protection Act.

Last modified 28 Jan 2024
Online Privacy

No specific regulation is in place regarding online privacy in El Salvador.

Last modified 28 Jan 2024
Contacts
Fernando Argumedo
Fernando Argumedo
Associate
Central Law
T +503 2241 3600
Francisco Murillo
Francisco Murillo
Associate
Central Law
T +503 2241 3600
Last modified 28 Jan 2024