Data protection & privacy laws in El Salvador (2026)

Legislative Decree No. 144 was approved on 12 November 2024, published in the Diario Oficial on 15 November 2024, and entered into force on 23 November 2024, making El Salvador the first Central American country with both a data-protection and a cybersecurity law simultaneously enacted.

The Agencia de Ciberseguridad del Estado (ACE), created by Decreto No. 143, is the sole supervisory body; it controls, inspects, and sanctions obligated entities, issues binding guidelines within three months of the law's effective date, and manages data-protection certification seals.

The law recognises six rights: Access, Rectification, Cancellation, Opposition, Portability, and the right to be Forgotten/Limitation (Olvido y Limitación). Entities must enable full exercise of these rights within six months of the law's effective date.

Obligated entities must: appoint a Data Protection Officer; obtain informed (written for sensitive data) consent before processing; implement technical and organisational security measures; and notify the ACE, the Attorney General's Office, and affected individuals of a data breach within 72 hours.

Cross-border transfers are permitted only when the destination country guarantees a level of protection equivalent to or greater than that of El Salvador; transfers to third parties generally require the data subject's express consent.

Administrative fines range from approximately USD 408.80 (minor infractions) to USD 16,352 (serious infractions), calibrated by gravity, recurrence, and damage caused; the ACE is the sanctioning authority.