El SalvadorLey para la Protección de Datos Personales, personal data breach notification
Decreto Legislativo No. 144, art. 25 (personal data breach notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the Agencia de Ciberseguridad del Estado, the Fiscalia General de la Republica, and every affected data subject of a personal data breach within seventy two hours of becoming aware of it.NIST Privacy FrameworkCM.AW-P7
- Within that same seventy two hours, begin a thorough review of the breach's magnitude, adopt corrective and preventive measures, and update your security policies to prevent a recurrence.NIST Privacy FrameworkPR.PO-P7NIST Privacy FrameworkGV.MT-P6
- Tell the Agencia de Ciberseguridad del Estado, in clear and simple language, the incident's nature, the personal data compromised, the immediate corrective actions taken, recommendations for the data subject, and where to learn more, and give the affected data subject the incident's nature, the data compromised, the recommendations, and where to learn more.NIST Privacy FrameworkCM.AW-P7
- Document every breach that risks the security of personal data, noting its date, cause, related facts, effects and corrective measures, and keep that record available to the Agencia de Ciberseguridad del Estado.NIST Privacy FrameworkPR.PO-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P6Policies, processes, and procedures incorporate lessons learned from problematic data actions.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.PO-02Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
- RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
- RS.AN-08An incident's magnitude is estimated and validated
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time
Logging duty
Article 25 has the controller document every breach that risks the security of personal data, whether or not it is notified, recording the date, the reason, the related facts, the effects and the corrective measures, and keep that record available to the authority in charge. The record is therefore a breach register that the authority may ask to see. The same article sets the 72-hour notice to the Agencia de Ciberseguridad del Estado, the Fiscalia General and the data subjects, which is a notification and not a record. The article sets no retention period and contains no territorial scope clause.
- Kind
- Explicit
- As of
- Provision
- Article 25, last paragraph (every breach documented with its date, reason, facts, effects and corrective measures, and kept available to the authority)
- Trigger
- security_incident
What this law does
Article 25 requires a responsible party, on learning of a personal data breach in any phase of processing, meaning any damage, loss, alteration, destruction, illegitimate access, or other unlawful or unauthorized use of personal data, including an accidental one, to notify the Agencia de Ciberseguridad del Estado, the Fiscalia General de la Republica, and the affected data subjects, within a maximum period of seventy two hours from becoming aware of the breach.
Within that same seventy two hours the responsible party must begin a thorough review to gauge the breach's magnitude, adopt corrective and preventive measures, and update its security policies.
The notification to the Entidad Rectora must be in clear, simple language and state the incident's nature, the personal data compromised, the immediate corrective actions taken, recommendations to the data subject, and where the data subject can learn more, while the notification to affected data subjects need only carry the incident's nature, the data compromised, the recommendations, and where to learn more.
The responsible party must also document every breach that risks the security of personal data, noting at least its date, cause, related facts, effects, and the corrective measures taken, and keep that record available to the supervisory authority.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .