Data protection & privacy law in El Salvador (2026)

Parliament approved a $12 million budget transfer to stand up the Agencia de Ciberseguridad del Estado (ACE), the authority designated under Decree 143/144 to enforce the data-protection and cybersecurity laws. ACE must issue implementing regulations within three months of becoming operational.

HRW published a detailed report arguing that Decree 144's sweeping 'right to erasure' of online content deemed 'inadequate' and Decree 143's surveillance powers threaten independent journalism and political opposition. Civil-society organizations filed complementary objections with the Legislative Assembly.

El Salvador's first comprehensive data-protection statute took effect, conferring ARCO-POL rights (access, rectification, cancellation, opposition, portability, erasure, limitation), requiring mandatory Data Protection Officers, regulating cross-border transfers, and designating ACE as the sanctioning supervisory authority for both public and private sectors.

With 57 votes in favour, the Asamblea approved both instruments published in Official Gazette No. 219, Vol. 445 on 15 November 2024, making El Salvador the first Central American country to enact a dedicated cybersecurity law alongside a standalone personal-data protection regime.

Hacking group CiberInteligenciaSV published source code of the state Bitcoin-ATM network and internal VPN access credentials on BreachForums; the Bukele government issued no public statement, exposing the absence of a mandatory breach-notification framework and amplifying calls for data-protection legislation.

CiberInteligenciaSV leaked a 144 GB database containing full names, national ID numbers, birth dates, home addresses, and high-resolution facial photographs of approximately 5.1 million adults — nearly the entire adult population — gathered during Chivo wallet KYC onboarding. No law at that time required the government to notify affected individuals.

The Instituto de Acceso a la Información Pública adopted a binding resolution tightening data-minimisation, access, and disclosure obligations for government agencies under the LAIP framework — the most substantive regulatory action on data protection between the 2021 veto and the 2024 statute.

Legislative Decree No. 57 (June 2021) made Bitcoin legal tender and backed the Chivo wallet, whose KYC onboarding collected biometric photographs, national ID numbers, and addresses from citizens at national scale. This mass data collection occurred with no sector-specific data-protection statute in place following the May 2021 veto.

Bukele returned the bill passed by the outgoing assembly on 22 April 2021, citing misalignment with the broader legal framework, lack of technical expertise in the proposed supervisory authority, and no budget appropriation. The veto left El Salvador without a dedicated data-protection statute for three years.

The pre-Bukele legislature approved a comprehensive GDPR-inspired personal data protection bill days before the new Nuevas Ideas-dominated assembly was sworn in; the bill was subsequently vetoed, marking the start of a three-year legislative gap during which large-scale biometric data collection began via Chivo.

The constitutional chamber elaborated on Article 2 protections, holding that citizens have judicially enforceable rights to control how personal data held by third parties is collected, stored, and transmitted. This ruling became the primary legal instrument for data-rights claims in the absence of a dedicated statute.

Legislative Decree No. 534 (approved 2 December 2010) was published in Official Gazette No. 70, Vol. 391, creating the first legal framework governing personal data held by public bodies and establishing the IAIP as El Salvador's inaugural data-rights oversight institution; the implementing regulation followed in September 2011.

The constitutional chamber held that Article 2 of the 1983 Constitution shields individuals against arbitrary use of their personal data in public or private records, establishing the constitutional foundation for data-rights litigation and shaping jurisprudence for the two decades before a dedicated statute was enacted.

The 1983 Constitution guaranteed every person the right to honour, personal and family privacy, and self-image under Article 2. This clause served as the sole constitutional anchor for data-protection and privacy claims for four decades until dedicated legislation was finally enacted in 2024.