El Salvador. Comprehensive data protection. Law
LPDP El SalvadorPersonal Data Protection Law (Ley de Protección de Datos Personales, Legislative Decree No. 144)
Partly verified
Medium confidence.Decree number 144 from MoFo listing. Exact entry-into-force mechanics, breach and transfer rules not verified. DLA Piper page (2024) outdated - refers to 2021 vetoed bill.
§1Summary
- Synopsis
El Salvador's first comprehensive data protection law, approved alongside a cybersecurity law. It regulates collection, use, storage and processing of personal data, recognises a right to be forgotten including de-indexing, and assigns supervision to the State Cybersecurity Agency.
- Key themes
- Unique features
Supervisor is the cybersecurity agency rather than an independent DPA; fines indexed to the commerce-sector minimum wage.
- SaaS relevance
SaaS providers processing Salvadoran personal data must honour rights including erasure/de-indexing and appoint a data protection delegate where required.
§2Obligations
- DPO
- Conditional
- Maximum penalty
- 1 to 40 times commerce-sector minimum monthly wage
§3Dates
- Key dates
- Adopted
- In force
- Approved 2024-11-12, published Diario Oficial 2024-11-15; ACE data-handling policies applicable from Sept 2025
§4Text and authority
- Text
- Authoritative text diariooficial.gob.sv
- Authority
- Agencia de Ciberseguridad del Estado (ACE)
§5Where it applies
- Domestic law of
- El Salvador
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Decree number 144 from MoFo listing. Exact entry-into-force mechanics, breach and transfer rules not verified. DLA Piper page (2024) outdated - refers to 2021 vetoed bill.