This story has been updated - please see the most recent update below On November 13, 2024, the Legislative Assembly of El Salvador announced that it approved a Data Protection Law and a Cybersecurity and Information Security Law. What are the main aspects of the Data Protection Law? The Data Protection Law regulates the processing of personal data, determining the requirements for the correct use of personal data. Scope The Data Protection Law applies to natural and legal persons, and public and private entities, that process personal data. However, the Data Protection Law does not apply to: credit history data; personal information used exclusively for domestic purposes, as well as perso
News
El Salvador: Legislative Assembly approves Data Protection Law and Cybersecurity Law
December 3, 2024
Summary
El Salvador's Legislative Assembly approved a Data Protection Law and a Cybersecurity Law on November 13, 2024, which regulate personal data processing and establish a State Cybersecurity Agency as the supervisory authority. The Data Protection Law outlines principles, data subject rights, and obligations for data controllers, excluding certain data types like credit history and data used for domestic purposes. The Cybersecurity Law mandates entities to create a cybersecurity strategy and includes guiding principles and definitions for terms like 'incident' and 'critical infrastructure.' Both laws were published in the Official Gazette on November 15, 2024, and took effect eight days later.