Cybersecurity law & regulation in El Salvador (2026)
Cybersecurity in El Salvador: comprehensive law.
On 12 November 2024 El Salvador's Legislative Assembly passed Decreto No. 143, the Cybersecurity and Information Security Law, the first standalone comprehensive cybersecurity statute in Central America, together with a companion personal-data-protection law (Decreto No. 144). Both laws entered into force on 23 November 2024, creating the State Cybersecurity Agency (ACE) as the autonomous national regulator. The regime covers all public and private entities that manage public administration systems or critical national infrastructure, imposing mandatory cybersecurity management systems and a 72-hour breach-notification duty.
Legal framework
Ley de Ciberseguridad y Seguridad de la Información (Decreto Legislativo No. 143, November 2024); complemented by Ley para la Protección de Datos Personales (Decreto No. 144, November 2024); administered by the Agencia de Ciberseguridad del Estado (ACE)
Key points: cybersecurity in El Salvador
Decree No. 143, Cybersecurity Law in force
Approved 12 November 2024, published in the Official Gazette 15 November 2024, and in force from 23 November 2024. It is the first comprehensive cybersecurity statute in Central America and applies to both public entities and private operators of critical infrastructure.
State Cybersecurity Agency (ACE) established
The law creates the Agencia de Ciberseguridad del Estado (ACE) as an autonomous national body responsible for developing the National Cybersecurity and Information Security Policy (NCISP), issuing binding standards, qualifying critical-infrastructure operators, and imposing sanctions for non-compliance.
Scope, critical infrastructure and public entities
All government bodies, autonomous institutions, municipal authorities, and any public or private entity that manages public resources or plays a role in national critical infrastructure must implement permanent cybersecurity management systems aligned with the NCISP and international best practices, including operational-continuity plans.
72-hour breach and incident notification
Regulated entities must notify ACE, the Attorney General's Office, and affected data subjects of any security breach within a maximum of 72 hours of discovery, mirroring the notification model in the companion personal-data-protection law (Decreto No. 144).
Companion personal-data-protection law (Decreto No. 144)
Enacted simultaneously, Decreto No. 144 is El Salvador's first dedicated data-protection statute, applying to both public and private sectors. It reinforces the cybersecurity framework by requiring data controllers to maintain appropriate security measures and observe the 72-hour breach-notification obligation.
Prior policy foundation, Executive Order 163 (2022)
Before the 2024 law, Executive Order No. 163 of 13 May 2022 established guidelines for cybersecurity risk prevention and management, called for creation of a coordinating cybersecurity entity, and promoted international cooperation, laying the institutional groundwork that ACE now fulfils.
Timeline of decisions
- Guidance · officialACE Issues First Binding Data Security Measures Policy
El Salvador's Agencia Estatal de Ciberseguridad (ACE) published its inaugural policy on data security measures, setting mandatory technical and organizational standards for public entities and regulated private actors obligated under the November 2024 cybersecurity law. This was the first binding regulatory guidance issued by the new agency.
Agencia Estatal de Ciberseguridad (ACE)
- Decision · officialLegislative Assembly Appropriates $12 Million to Operationalize ACE
El Salvador's Legislative Assembly reformed the 2025 General State Budget to transfer $12 million to the Justice and Security portfolio to fund the newly created State Cybersecurity Agency (ACE), with $11.28M designated for national cybersecurity regulation and $714K for agency administration. Without this appropriation ACE could not begin operating.
Asamblea Legislativa de El Salvador
- Law · officialCybersecurity Law and Personal Data Protection Law Enacted (Decrees 143 & 144)
El Salvador's Legislative Assembly approved Decreto 143 (Cybersecurity and Information Security Law) and Decreto 144 (Personal Data Protection Law), published in the Official Gazette November 15 and effective November 23. Decreto 143 created the State Cybersecurity Agency (ACE) under a presidential appointee; Decreto 144 established data subject rights and a sweeping 'right to be forgotten' that critics — including Human Rights Watch — say grants the executive undue power to order removal of news articles and public-interest content from the internet.
Library of Congress Global Legal Monitor
- Law · officialLegislative Assembly Enacts Cybersecurity and Information Security Law (Decree 143) and Personal Data Protection Law (Decree 144)
El Salvador's Legislative Assembly approved its first comprehensive cybersecurity statute, creating the Agencia Estatal de Ciberseguridad (ACE) as the national regulator; both laws were published in the Official Gazette on 15 November and entered into force on 23 November 2024, making El Salvador the first Central American country to enact a dedicated cybersecurity law paired with sector-wide data protection rules.
Asamblea Legislativa de El Salvador
- Law · officialCybersecurity and Information Security Law Enacted; State Cybersecurity Agency (ACE) Created
The Legislative Assembly passed El Salvador's first comprehensive cybersecurity statute, creating the State Cybersecurity Agency (ACE) as the national coordinator for cybersecurity policy. ACE's mandate covers securing digital and AI infrastructure, complementing both the Data Protection Law and the forthcoming AI regulatory framework.
U.S. International Trade Administration
- Law · officialReforms to Ley Especial Contra los Delitos Informáticos Increase Penalties and Introduce Data Management Definitions
The Legislative Assembly amended the 2016 Special Computer Crimes Law to raise penalties for computer fraud from 6-10 to 10-12 years imprisonment and added formal legal definitions for Data Owner, Data Controller, Data Processor, and Metadata, signalling a shift toward data-centric criminal liability in advance of the November 2024 framework legislation.
Asamblea Legislativa de El Salvador
- IncidentCiberInteligenciaSV Leaks 10+ Salvadoran Police Investigation Databases
The Salvadoran threat actor group CiberInteligenciaSV published more than ten separate police database dumps on BreachForums, exposing records on disappearances, vehicles, extortions, and weapons, revealing systemic weaknesses in government network security and law-enforcement data handling months before the new cybersecurity law was passed.
Constella Intelligence
- IncidentChivo Government Bitcoin Wallet Source Code and ATM VPN Credentials Published on BreachForums
CiberInteligenciaSV released source code and VPN access credentials for the state-owned Chivo Bitcoin wallet's ATM network on BreachForums, exposing critical payments infrastructure to potential unauthorized access; the government denied any compromise of user funds but issued no formal investigation statement.
CoinTelegraph
- Incident5.1 Million Salvadorans' Biometric PII Leaked in 144 GB BreachForums Dump
CiberInteligenciaSV published a 144 GB trove containing full names, DUI identity numbers, dates of birth, addresses, phone numbers, and high-definition headshots of approximately 5.1 million Salvadorans, roughly 80% of the population, creating acute identity-theft and biometric-misuse risks and directly accelerating the legislative push for data-protection law.
Resecurity
- GuidanceExecutive Order 1633: First National Cybersecurity Policy (Política de Ciberseguridad) Published
President Bukele issued Executive Decree 1633 establishing the Política de Ciberseguridad de El Salvador, the country's first formal national cybersecurity policy, mandating cybersecurity goals across the executive branch and encouraging adoption by critical-infrastructure operators, and tasking the government to create a dedicated coordinating body, laying the administrative groundwork for the 2024 legislation.
U.S. International Trade Administration
- Law · officialLey Especial Contra los Delitos Informáticos y Conexos Enacted (Decree 260), Foundational Cybercrime Law
El Salvador's Legislative Assembly enacted Legislative Decree 260, the Special Law Against Computer and Related Crimes, criminalising unauthorised system access, computer fraud, data manipulation, identity theft, and digital espionage with penalties of 1-12 years imprisonment, and requiring the National Civil Police and Attorney General's Office to maintain specialist cybercrime investigation capacity, the foundational legal framework that remained the sole cybersecurity statute for nearly a decade.
Jurisprudencia — Corte Suprema de Justicia de El Salvador
Sources
- asamblea.gob.sv/sites/default/files/documents/decretos/D056D9A1-299D-4188-941A-9C3B58
- loc.gov/item/global-legal-monitor/2025-01-21/el-salvador-cybersecurity-and-da
- trade.gov/market-intelligence/el-salvador-ict-cybersecurity-and-information-sec
- ace.gob.sv/
- asamblea.gob.sv/node/13376
- blplegal.com/cybersecurity-and-information-security-law-in-el-salvador/
- garciabodan.com/en/el-salvadors-legislative-assembly-approves-cybersecurity-law/
- trade.gov/market-intelligence/el-salvador-new-cybersecurity-policy
- garciabodan.com/en/el-salvador-strengthens-personal-data-protection/
- asamblea.gob.sv/node/13370
Next for El Salvador: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026