Data protection & privacy law in El Salvador (2026)
Data protection in El Salvador: comprehensive law.
El Salvador enacted its first comprehensive personal-data protection law (Decreto 144) in November 2024, covering both public and private sector entities that process personal data within or outside national territory. The law is modelled on GDPR-style principles, lawful basis, data minimisation, transparency, accountability, and grants data subjects ARCO-POL rights. Enforcement and supervision are delegated to the newly created State Cybersecurity Agency (ACE).
Legal framework
Ley de Protección de Datos Personales, Decreto Legislativo No. 144 (November 12, 2024; in force November 23, 2024), enforced by the Agencia de Ciberseguridad del Estado (ACE), established by the companion Ley de Ciberseguridad y Seguridad de la Información, Decreto Legislativo No. 143
Key points: data & privacy in El Salvador
Enactment & entry into force
Legislative Decree No. 144 was approved on 12 November 2024, published in the Diario Oficial on 15 November 2024, and entered into force on 23 November 2024, making El Salvador the first Central American country with both a data-protection and a cybersecurity law simultaneously enacted.
Supervisory authority (ACE)
The Agencia de Ciberseguridad del Estado (ACE), created by Decreto No. 143, is the sole supervisory body; it controls, inspects, and sanctions obligated entities, issues binding guidelines within three months of the law's effective date, and manages data-protection certification seals.
Data subject rights (ARCO-POL)
The law recognises six rights: Access, Rectification, Cancellation, Opposition, Portability, and the right to be Forgotten/Limitation (Olvido y Limitación). Entities must enable full exercise of these rights within six months of the law's effective date.
Key controller obligations
Obligated entities must: appoint a Data Protection Officer; obtain informed (written for sensitive data) consent before processing; implement technical and organisational security measures; and notify the ACE, the Attorney General's Office, and affected individuals of a data breach within 72 hours.
International data transfers
Cross-border transfers are permitted only when the destination country guarantees a level of protection equivalent to or greater than that of El Salvador; transfers to third parties generally require the data subject's express consent.
Sanctions regime
Administrative fines range from approximately USD 408.80 (minor infractions) to USD 16,352 (serious infractions), calibrated by gravity, recurrence, and damage caused; the ACE is the sanctioning authority.
Timeline of decisions
- GuidanceHuman Rights Watch Warns New Laws Enable State Surveillance and Press Censorship
HRW published a detailed report arguing that Decree 144's sweeping 'right to erasure' of online content deemed 'inadequate' and Decree 143's surveillance powers threaten independent journalism and political opposition. Civil-society organizations filed complementary objections with the Legislative Assembly.
Human Rights Watch
- LawPersonal Data Protection Law and Cybersecurity Law Enter into Force
El Salvador's Personal Data Protection Law (LPD) became effective, imposing data-handling obligations on fintech and digital-asset firms processing Salvadoran user data. In the same month the Cybersecurity and Information Security Law (Decree No. 143) took effect, creating the national cybersecurity agency ACE and mandating incident reporting and risk-governance requirements for financial-sector operators.
Consortium Legal
- LawPersonal Data Protection Law (Decree No. 144) Takes Effect
El Salvador's first dedicated data-protection statute granted citizens ARCO-POL rights (Access, Rectification, Cancellation, Opposition, Portability, Oblivion, Limitation) and imposed consent, transparency, and data-minimization obligations on all processors — establishing the privacy guardrails that the 2025 AI Law explicitly requires AI systems to respect.
Central Law
- Law · officialPersonal Data Protection Law (Decree 144) and Cybersecurity Law (Decree 143) Enter into Force
El Salvador's first comprehensive data-protection statute took effect, conferring ARCO-POL rights (access, rectification, cancellation, opposition, portability, erasure, limitation), requiring mandatory Data Protection Officers, regulating cross-border transfers, and designating ACE as the sanctioning supervisory authority for both public and private sectors.
Asamblea Legislativa de El Salvador – Decreto No. 144
- Law · officialLegislative Assembly Approves Twin Laws: Data Protection (Decree 144) and Cybersecurity (Decree 143)
With 57 votes in favour, the Asamblea approved both instruments published in Official Gazette No. 219, Vol. 445 on 15 November 2024, making El Salvador the first Central American country to enact a dedicated cybersecurity law alongside a standalone personal-data protection regime.
Asamblea Legislativa de El Salvador
- IncidentChivo Wallet Source Code and VPN Credentials Leaked on BreachForums
Hacking group CiberInteligenciaSV published source code of the state Bitcoin-ATM network and internal VPN access credentials on BreachForums; the Bukele government issued no public statement, exposing the absence of a mandatory breach-notification framework and amplifying calls for data-protection legislation.
The Block
- Incident5.1 Million Salvadorans' KYC Biometric Data Exposed in Chivo Wallet Breach
CiberInteligenciaSV leaked a 144 GB database containing full names, national ID numbers, birth dates, home addresses, and high-resolution facial photographs of approximately 5.1 million adults — nearly the entire adult population — gathered during Chivo wallet KYC onboarding. No law at that time required the government to notify affected individuals.
The Cryptonomist
- Guidance · officialIAIP Issues Formal Regulation Strengthening Personal Data Rules for Public Entities
The Instituto de Acceso a la Información Pública adopted a binding resolution tightening data-minimisation, access, and disclosure obligations for government agencies under the LAIP framework — the most substantive regulatory action on data protection between the 2021 veto and the 2024 statute.
IAIP / Centro de Documentación Judicial de El Salvador
- Law · officialState of Exception Declared; Warrantless Digital Surveillance Authorized by Criminal Code Reform
President Bukele proclaimed a state of exception in response to gang violence (renewed over 41 times through 2025), suspending rights to counsel and assembly. Separately, 2022 reforms to the Criminal Procedure Code granted the Attorney General's Office sweeping authority to conduct undercover digital monitoring — including interception of private communications — without a court warrant and without restrictions on scope or duration, raising serious concerns about surveillance of journalists and opponents.
U.S. Department of State — 2022 El Salvador Human Rights Report
- Law · officialBitcoin Law Takes Effect; Chivo Wallet Creates Largest Centralised Personal-Data Collection in Country's History
Legislative Decree No. 57 (June 2021) made Bitcoin legal tender and backed the Chivo wallet, whose KYC onboarding collected biometric photographs, national ID numbers, and addresses from citizens at national scale. This mass data collection occurred with no sector-specific data-protection statute in place following the May 2021 veto.
Banco Central de Reserva de El Salvador
- DecisionPresident Bukele Vetoes First Comprehensive Data Protection Bill
Bukele returned the bill passed by the outgoing assembly on 22 April 2021, citing misalignment with the broader legal framework, lack of technical expertise in the proposed supervisory authority, and no budget appropriation. The veto left El Salvador without a dedicated data-protection statute for three years.
El Salvador.com
- LawOutgoing Legislative Assembly Passes El Salvador's First Standalone Data Protection Law
The pre-Bukele legislature approved a comprehensive GDPR-inspired personal data protection bill days before the new Nuevas Ideas-dominated assembly was sworn in; the bill was subsequently vetoed, marking the start of a three-year legislative gap during which large-scale biometric data collection began via Chivo.
VOCES Diario Digital (El Salvador)
- Decision · officialSala de lo Constitucional Clarifies Scope of Informational Self-Determination (Process 142-2012)
The constitutional chamber elaborated on Article 2 protections, holding that citizens have judicially enforceable rights to control how personal data held by third parties is collected, stored, and transmitted. This ruling became the primary legal instrument for data-rights claims in the absence of a dedicated statute.
Sala de lo Constitucional – Corte Suprema de Justicia de El Salvador
- Law · officialLaw on Access to Public Information (LAIP, Decree 534) Published; IAIP Established
Legislative Decree No. 534 (approved 2 December 2010) was published in Official Gazette No. 70, Vol. 391, creating the first legal framework governing personal data held by public bodies and establishing the IAIP as El Salvador's inaugural data-rights oversight institution; the implementing regulation followed in September 2011.
Fiscalía General de la República de El Salvador – LAIP Text
- Decision · officialSala de lo Constitucional Recognises Constitutional Right to Informational Self-Determination (Amparo 934-2007)
The constitutional chamber held that Article 2 of the 1983 Constitution shields individuals against arbitrary use of their personal data in public or private records, establishing the constitutional foundation for data-rights litigation and shaping jurisprudence for the two decades before a dedicated statute was enacted.
Sala de lo Constitucional – Corte Suprema de Justicia de El Salvador
- Law · officialConstitution of El Salvador (Art. 2) Enshrines Right to Privacy as Fundamental Right
The 1983 Constitution guaranteed every person the right to honour, personal and family privacy, and self-image under Article 2. This clause served as the sole constitutional anchor for data-protection and privacy claims for four decades until dedicated legislation was finally enacted in 2024.
OAS – Constitución de la República de El Salvador (1983)
Sources
- asamblea.gob.sv/sites/default/files/documents/decretos/7A4FBD85-7E1B-46BE-9408-6FC549
- transparencia.mh.gob.sv/downloads/pdf/700-UAIP-LY-2024-14993.pdf
- loc.gov/item/global-legal-monitor/2025-01-21/el-salvador-cybersecurity-and-da
- central-law.com/en/el-salvador-new-personal-data-protection-law-keys-to-compliance-an
- altalegal.com/en/comunicacion/la-nueva-ley-salvadorena-de-proteccion-de-datos-perso
- dlapiperdataprotection.com/index.html?t=law&c=SV
- inplp.com/latest-news/article/el-salvadors-new-data-protection-law/
- dataguidance.com/jurisdictions/el-salvador
- asamblea.gob.sv/sites/default/files/documents/decretos/D056D9A1-299D-4188-941A-9C3B58
- garciabodan.com/en/el-salvador-strengthens-personal-data-protection/
Next for El Salvador: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026