El SalvadorLey para la Protección de Datos Personales
Decreto Legislativo No. 144 12 de noviembre de 2024, arts. 1-5, 26-36, 40, 46-49 and 60-64 (general provisions, lawful basis and accountability)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance, Security, Disclosure, Retention
- Audit expectation
- none
What it requires
- Obtain a person's express, informed, free, specific and individualized consent, or another lawful basis this Law recognizes such as contractual necessity, a legal obligation, vital interests, or a legitimate interest that does not override the data subject's rights, before processing their personal data, unless this Law excuses consent for the specific processing.NIST Privacy FrameworkCT.PO-P1
- Collect only personal data that is sufficient, relevant and not excessive for your specific, legitimate purpose, and keep it accurate, complete and up to date.NIST Privacy FrameworkGV.PO-P1
- Let a data subject revoke their consent at any time without retroactive effect, and act on a revocation within five business days of the request.NIST Privacy FrameworkCT.PO-P1
- If you are a private entity, process a data subject's data only for the services you actually provide them, and do not transfer or use a third party's data for a different purpose without that party's authorization.NIST Privacy FrameworkGV.PO-P1
- Document your ARCO-POL request procedures, and hold any subcontractor with access to personal data to this Law.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkID.DE-P3
- Maintain the technological, regulatory and procedural security measures the Entidad Rectora sets to keep personal data confidential, available and unaltered.NIST Privacy FrameworkPR.DS-P5
- Before transferring personal data to another party, obtain the data subject's prior consent and tell them the transfer's purpose and the recipient's identity.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 27(d) requires consent to be unequivocal so that its grant can be demonstrated, and Article 26 requires it to be recorded by physical, electronic or other technological means, so the controller must keep a record of each consent. Article 33 adds that the controller establishes and documents its procedures for ARCO-POL requests. Articles 50 and 54, which give the Agencia de Ciberseguridad del Estado its inspection power and put the burden of proving consent on the controller, sit outside the articles this row cites and are coded on the enforcement row. Article 5(h) limits how long personal data are kept, not a log, and is not coded as retention. Article 2 applies the Law to any person processing personal data and to public bodies inside or outside the territory, and states no establishment, targeting or residence test, so no hook is coded.
- Kind
- Implicit
- As of
- Provision
- Article 27(d) with Article 26 (consent that can be demonstrated and is recorded by physical or electronic means) and Article 33 (documented ARCO-POL procedures)
- Trigger
- consent_or_optout
- personal_data_processing
What this law does
Article 1 sets the Law's object as regulating the lawful and informed treatment of personal data to guarantee the right to privacy and informational self determination, and article 2 binds any natural or legal person, public or private, that processes personal data manually, partially or fully automated, or through a third party, including one that processes personal data without meeting this Law's requirements, while subjecting organs of the State and municipal authorities specifically to Title III.
Article 3 excludes credit history data already regulated by its own statute, except for financial system supervised entities' non credit data, purely personal or domestic processing, public safety and criminal justice processing, and processing under the civil registry and national identity document statutes.
Article 5 states ten governing principles: accuracy, loyalty, consent and purpose, data minimization, transparency in plain language, security, a six ground lawful basis test built on consent, contractual necessity, a legal obligation, vital interests, public interest, or legitimate interest, storage limitation, demonstrated accountability, and progressive exercise of children's faculties.
Article 26 requires consent to be express, given verbally, in writing, or through unequivocal signs recorded by a physical, electronic, or other technological means, and article 27 requires that consent to be free, specific, informed, express, and individualized.
Article 28 excuses consent for personal data from a publicly accessible source that is not sensitive, medical emergencies, dissociated data, missing persons, contractual or scientific relationships, data the data subject has already made public, and historical or scientific archives. Articles 29 and 31 let a data subject revoke consent at any time without retroactive effect and complain to the Entidad Rectora over a refused revocation.
Article 30 as amended requires the obligated party to act on a revocation within five business days. Article 32 confines a private entity's processing to data directly related to the services it provides that data subject, and bars transferring or processing a third party's data for another purpose without that party's authorization. Article 33 requires a documented ARCO POL procedure and requires any subcontractor with access to personal data to submit to this Law.
Article 34 requires the responsible party to limit processing to the purpose consented to, implement security measures, and keep the data confidential, and article 36 requires the responsible party and any processor to maintain the security measures the Entidad Rectora sets for integrity, availability, and confidentiality. Article 40 conditions any transfer of personal data on the data subject's prior consent, informed of the transfer's purpose and the identity of the recipient.
Title III's articles 46 to 49 let a public body process personal data within its legal competence without the data subject's consent, while preserving a narrower set of ARCO POL rights, an information duty, and a bar on transferring or disseminating the data outside listed exceptions. Article 64 brings the decree into force eight days after its publication in the Diario Oficial, following its adoption and Diario Oficial publication.
Legislative Decree 659 of amended articles 2, 16, 18 to 22, 24, 30, 47, 48 and 51 of the Law and repealed articles 15 and 17. Legislative Decree 659 was published in the Diario Oficial, number 173, Tomo 452, on . Legislative Decree 659 entered into force eight days after that publication, on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .