Processes personal data, in El Salvador

Decreto Legislativo No. 695 of 2011 (Ley de Regulación de los Servicios de Información sobre el Historial de Crédito de las Personas), arts. 5, 8, 12, 17(g) and (j), 19(e) and (f) and 31 (authorization and duties of credit-history information agencies) · Read the law's page

• If you want to operate an agency that collects and supplies consumers' credit-history data, obtain authorization from the Superintendencia del Sistema Financiero first, and do not operate without it; a private agency must hold at least one hundred fifty thousand US dollars of share capital, fully subscribed and paid in cash.
• If you run a credit-history information agency, let the Superintendencia del Sistema Financiero audit your computer system, delete negative credit-history data permanently within three years of its entry into your database, and do not market your databases as a whole or hand over all the credit information they hold.

Ley de Regulación de los Servicios de Información sobre el Historial de Crédito de las Personas (Decreto Legislativo No. 695 of 2011), arts. 4(a), 19(h), 20-25 and 28-30 · Read the law's page

• If you hold credit-history data on consumers or clients, tell a consumer or client who proves their identity whether you are processing their credit-history information, and give them a copy when they ask.
• Rectify or delete a credit-history record that is unlawful, erroneous, unjustified or inaccurate when the consumer or client asks, and answer a request for access, rectification, modification or cancellation within five business days.
• Do not use, transfer, share or market the credit-history information in your database without the express consent of the person it concerns.

Ley de Deberes y Derechos de los Pacientes y Prestadores de Servicios de Salud (Decreto Legislativo No. 307 of 2016), arts. 20, 42(g), 42(l), 43(b), 45 and 46 · Read the law's page

• If you provide health services, public or private, respect the confidential character of a patient's clinical record and of all information on their diagnosis, treatment, stay, prognosis and illness, and disclose it only on the patient's written authorization or for imperative legal or medical reasons.
• Do not publicly disclose the medical and clinical information on a patient's health that you obtained in giving care.
• Do not damage, alter or remove sheets of a patient's clinical record.
• Give care and perform procedures in a way that safeguards the patient's intimacy and privacy.

Ley de Prevención y Control de la Infección Provocada por el Virus de Inmunodeficiencia Humana (Decreto Legislativo No. 562 of 2016), arts. 26, 27, 30, 34(c) and 35 · Read the law's page

• Do not request a test to diagnose HIV infection by any means or for any reason, and do not use deception or routine tests to infer a person's HIV status.
• Do not require an HIV test as a condition of entering the country, obtaining goods or services, or joining a public or private institution or workplace.
• Do not reveal information about a person's HIV condition or diagnosis without their consent.
• If you are a public or private health institution or a health professional, report people diagnosed with HIV, and HIV-related deaths, to the Ministry of Health for epidemiological purposes, guaranteeing confidentiality.

Decreto Legislativo No. 144, 12 de noviembre de 2024, arts. 1-5, 26-36, 40, 46-49 and 60-64 (general provisions, lawful basis and accountability) · Read the law's page

• Obtain a person's express, informed, free, specific and individualized consent, or another lawful basis this Law recognizes such as contractual necessity, a legal obligation, vital interests, or a legitimate interest that does not override the data subject's rights, before processing their personal data, unless this Law excuses consent for the specific processing.
• Collect only personal data that is sufficient, relevant and not excessive for your specific, legitimate purpose, and keep it accurate, complete and up to date.
• Let a data subject revoke their consent at any time without retroactive effect, and act on a revocation within five business days of the request.
• If you are a private entity, process a data subject's data only for the services you actually provide them, and do not transfer or use a third party's data for a different purpose without that party's authorization.
• Document your ARCO-POL request procedures, and hold any subcontractor with access to personal data to this Law.
• Maintain the technological, regulatory and procedural security measures the Entidad Rectora sets to keep personal data confidential, available and unaltered.
• Before transferring personal data to another party, obtain the data subject's prior consent and tell them the transfer's purpose and the recipient's identity.

Decreto Legislativo No. 144, art. 25 (personal data breach notification) · Read the law's page

• Notify the Agencia de Ciberseguridad del Estado, the Fiscalia General de la Republica, and every affected data subject of a personal data breach within seventy two hours of becoming aware of it.
• Within that same seventy two hours, begin a thorough review of the breach's magnitude, adopt corrective and preventive measures, and update your security policies to prevent a recurrence.
• Tell the Agencia de Ciberseguridad del Estado, in clear and simple language, the incident's nature, the personal data compromised, the immediate corrective actions taken, recommendations for the data subject, and where to learn more, and give the affected data subject the incident's nature, the data compromised, the recommendations, and where to learn more.
• Document every breach that risks the security of personal data, noting its date, cause, related facts, effects and corrective measures, and keep that record available to the Agencia de Ciberseguridad del Estado.

Decreto Legislativo No. 144, arts. 35 and 50-59 (enforcement, infractions and sanctions) · Read the law's page

• Expect the Agencia de Ciberseguridad del Estado (ACE) to supervise, inspect, and exercise sanctioning power over you under this Law, and to issue mandatory operating policies and security measures you must follow.
• Expect a fine of one to ten monthly minimum wages of the commercial sector for a minor infraction, eleven to twenty five for a serious infraction, and twenty six to forty for a very serious infraction, without prejudice to any civil or criminal liability the same conduct also carries.
• Expect ACE to order remedial measures beyond a fine, and to publish its sanctioning resolutions on its website with personal data dissociated or anonymized.
• Carry the burden of proving that you obtained consent or delivered the privacy notice, and, for an international transfer, that the transfer was lawful.
• Do not process personal data without prior consent, deny an ARCO-POL request, use a child's data without parental consent, reverse a pseudonymization, or use, transfer, share or commercialize personal data in violation of this Law.

Decreto Legislativo No. 144, arts. 4(g), 26, 37, 38, 39 and 42 (sensitive personal data and children) · Read the law's page

• Do not compel a person to provide sensitive personal data (data touching physical or moral characteristics, or facts of private life whose misuse could cause discrimination or gravely harm honor or privacy, including religious belief, ethnic origin, political or union affiliation, sexual preference, health, or biometric or genetic information); take it only with the data subject's express and unequivocal consent after telling them of their right to withhold it.
• Obtain a sensitive data subject's consent in writing, by an autograph signature or its equivalent, and apply the Progressive Exercise of Faculties principle to a child's consent to provide their personal data.
• Process health data, as a health establishment or professional, only for a patient under your care and only for prevention, diagnosis, treatment or health service management, under professional secrecy.
• Collect or process sensitive personal data only where this Law authorizes it, another statute authorizes it for a general interest, you have a legal mandate, or the purpose is statistical or scientific and the data have been dissociated from the data subject.
• Do not create a database of sensitive personal data in violation of this Law.
• Guarantee the best interests of a child or adolescent in any processing of their data, and inform both the child and their parent or guardian, in clear and age appropriate language, before exercising the child's rights.

Decreto Legislativo No. 144, arts. 41, 44 and 45 (international transfer of personal data) · Read the law's page

• Before transferring personal data internationally, sign a contract with the receiving party that holds it to at least the same personal data protection obligations you carry.
• Before transferring personal data to another country or international organization, confirm the receiving country meets at minimum this Law's data protection principles or applicable international standards, and take appropriate measures to secure the data at the point of transfer if the receiving country's protection is not adequate.
• Obtain the data subject's prior consent before an international transfer of their personal data, unless a reciprocal treaty exception applies or the transfer falls under a Central American Economic Integration treaty.
• Report your cross border personal data flows to the Entidad Rectora together with the transfer information and your database's registration.

Decreto Legislativo No. 144, arts. 6-24 and 46-48 (ARCO-POL rights) · Read the law's page

• Let a data subject know whether you are processing their personal data, and give them, free of charge, an intelligible copy of it, telling them its origin and whether it was shared with other institutions.
• Tell a data subject, before you collect their data, its purpose, its recipients, the database it will sit in, how to reach you and your processor, the content of their ARCO-POL rights, and the security measures you keep; get a fresh authorization if you later plan a different purpose.
• Correct or update a data subject's personal data within twenty business days of the request, and block the data under review while you do.
• Erase a data subject's personal data without undue delay on request, including the right to be forgotten reaching search engine results and other data holders, subject only to this Law's listed exceptions.
• Stop processing a data subject's personal data, including profiling for direct marketing, as soon as they object, unless a listed exception applies, and limit processing on request while a dispute is pending.
• Give a data subject a structured, commonly used, machine readable and interoperable copy of their personal data, and transmit it to another responsible party at their request, where the processing rests on their consent and is automated.
• Answer an ARCO-POL request within twenty business days, extendable once by another twenty for justified cause, return a request you are not competent to handle within five business days, and notify anyone who received the data within five business days of deciding that a request to correct, update or delete it is proper.
• Charge nothing for exercising ARCO-POL rights beyond reproduction, certification or delivery costs, and give a reasoned written denial within three business days when you refuse a request.
• Publish a privacy notice, consistent with your privacy policy, naming your address, which data are sensitive, your legal basis, your purposes, how to exercise ARCO-POL rights and revoke consent, and your use of cookies, and give it to the data subject in writing before they consent.
• As a public body, appoint a data protection delegate, who may be your Information Officer, preserve a narrower set of ARCO-POL rights for the personal data you process without consent, and tell your users that their data may be collected and the means to exercise their rights.when it serves a public body