Makes health care decisions, in El Salvador

Decreto Legislativo No. 143, adopted November 2024, published Diario Oficial 15 November 2024, effective 23 November 2024

• If you administer or influence public administration or critical infrastructure, handle personal data according to the standards the State Cybersecurity Agency issues, which are aligned with ISO 27001.

Decreto Legislativo No. 144, arts. 6-24 and 46-48 (ARCO-POL rights) · Read the law's page

• Let a data subject know whether you are processing their personal data, and give them, free of charge, an intelligible copy of it, telling them its origin and whether it was shared with other institutions.
• Tell a data subject, before you collect their data, its purpose, its recipients, the database it will sit in, how to reach you and your processor, the content of their ARCO-POL rights, and the security measures you keep; get a fresh authorization if you later plan a different purpose.
• Correct or update a data subject's personal data within twenty business days of the request, and block the data under review while you do.
• Erase a data subject's personal data without undue delay on request, including the right to be forgotten reaching search engine results and other data holders, subject only to this Law's listed exceptions.
• Stop processing a data subject's personal data, including profiling for direct marketing, as soon as they object, unless a listed exception applies, and limit processing on request while a dispute is pending.
• Give a data subject a structured, commonly used, machine readable and interoperable copy of their personal data, and transmit it to another responsible party at their request, where the processing rests on their consent and is automated.
• Answer an ARCO-POL request within twenty business days, extendable once by another twenty for justified cause, return a request you are not competent to handle within five business days, and notify anyone who received the data within five business days of deciding that a request to correct, update or delete it is proper.
• Charge nothing for exercising ARCO-POL rights beyond reproduction, certification or delivery costs, and give a reasoned written denial within three business days when you refuse a request.
• Publish a privacy notice, consistent with your privacy policy, naming your address, which data are sensitive, your legal basis, your purposes, how to exercise ARCO-POL rights and revoke consent, and your use of cookies, and give it to the data subject in writing before they consent.
• As a public body, appoint a data protection delegate, who may be your Information Officer, preserve a narrower set of ARCO-POL rights for the personal data you process without consent, and tell your users that their data may be collected and the means to exercise their rights.when it serves a public body

Decreto Legislativo No. 234, art. 18 · Read the law's page

• When you use AI commercially, or to determine a person's access to rights or services in El Salvador, tell them whether the decision was made directly by the AI or was AI-driven, with a comprehensible and transparent explanation of the process.
• Give the person a way to challenge the decision before a competent natural person who can confirm, modify or revoke it.

Decreto Legislativo No. 234, arts. 7, 16, 17 y 27 · Read the law's page

• If your AI system handles data classified as confidential, reserved or personal, comply with the risk-evaluation framework the Agencia Nacional de Inteligencia Artificial (ANIA) sets.
• Register in the Registro Nacional de Desarrollo, Innovación y Aplicación de IA to obtain this law's safeguards for open-domain-data use, good-faith research and sandbox activity, and non-restrictive AI-model licensing.
• When you use personal data to develop, research or apply AI, comply with the Ley para la Protección de Datos Personales, under ANIA and ACE supervision.

Resolución No. 0001/2025, ANIA, art. 11 · Read the law's page

• If your AI system is the controlling factor in a decision that materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and it operates in a registrable sector (primary health diagnosis or treatment, creditworthiness or insurance and loan decisions, real-time biometric identification in public spaces, the exercise of government authority or public benefits, unsupervised hiring or compensation decisions, or academic admission or grading), register with ANIA.
• You may demonstrate compliance through self-certification, third-party certification, or ANIA's supervised sandbox.

Resolución No. 0001/2025, ANIA, art. 24 · Read the law's page

• If you use an AI system to make a decision about a person in El Salvador without meaningful human review, and it negatively affects their health, financial services, employment, education, government benefits, housing or transportation, notify them.
• In that notification, confirm that AI was involved, explain the role it played, and give the person a way to challenge the decision.
• This notification duty does not apply where disclosure would undermine fraud detection or cybersecurity, where the system supports law enforcement or national-security functions, or where the AI's role is limited to content recommendation, search results, ad optimization, or basic spellcheck or grammar assistance.