El SalvadorLey para la Protección de Datos Personales, enforcement and sanctions
Decreto Legislativo No. 144, arts. 35 and 50-59 (enforcement, infractions and sanctions)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Agencia de Ciberseguridad del Estado (ACE)
- Obligation class
- Governance, Reporting, Prohibition
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Agencia de Ciberseguridad del Estado (ACE) to supervise, inspect, and exercise sanctioning power over you under this Law, and to issue mandatory operating policies and security measures you must follow.
- Expect a fine of one to ten monthly minimum wages of the commercial sector for a minor infraction, eleven to twenty five for a serious infraction, and twenty six to forty for a very serious infraction, without prejudice to any civil or criminal liability the same conduct also carries.
- Expect ACE to order remedial measures beyond a fine, and to publish its sanctioning resolutions on its website with personal data dissociated or anonymized.
- Carry the burden of proving that you obtained consent or delivered the privacy notice, and, for an international transfer, that the transfer was lawful.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
- Do not process personal data without prior consent, deny an ARCO-POL request, use a child's data without parental consent, reverse a pseudonymization, or use, transfer, share or commercialize personal data in violation of this Law.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 57 fines a minor infraction one to ten, a serious infraction eleven to twenty five, and a very serious infraction twenty six to forty monthly minimum wages of the commercial sector. That is a multiple of a wage rather than a currency amount, so no fixed figure is stated: stating a cap would require a conversion into dollars the statute does not give. Article 58 preserves civil or criminal liability arising elsewhere rather than creating it.
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state, Disclosure shown
Logging duty
Article 54 puts the burden on the controller of showing that it obtained consent or communicated the privacy notice, and, for an international transfer, that the transfer followed the Law, which a controller can do only from records of the consent, the notice and the transfer. Article 50(a) and (t) give the Agencia de Ciberseguridad del Estado a standing power to inspect and to request documents about the processing, and Article 56(b)(4) treats obstructing its audits or inspections as a serious infraction, so the check waits on the Agencia deciding to look. An inspection leaves no report the controller owes anyone. The Agencia's own yearly audit of the certifications it issues (Article 50(l)) is a check on certificates, not on a controller's record. The cited articles state no territorial scope clause.
- Kind
- Implicit
- As of
- Provision
- Article 54 (the controller bears the burden of proving consent, delivery of the privacy notice and, for a transfer, its lawfulness), with Article 50(a) and (t) (inspection and requests for documents)
- Trigger
- consent_or_optout
- personal_data_processing
What this law does
Article 35 gives the Entidad Rectora, the Agencia de Ciberseguridad del Estado (ACE), power to dictate mandatory policies for managing personal data.
Article 50 lists ACE's attributes, among them supervising and inspecting obligated institutions, exercising sanctioning power, issuing provisional measures, promoting public awareness, resolving disputes over sensitive data classification, supporting responsible parties technically, cooperating with other supervisory authorities, issuing operating policies and security measures, certifying data protection compliance and auditing those certifications yearly, training public and private institutions, publishing implementation guides, and requesting information from public and private entities.
Article 51 gives the ACE Director General these powers except the power to sanction. Article 51 as amended has the President of the Republic appoint a Director of Data Protection to assist the Director General, for a three year term, who must meet the same requirements as ACE's Director of Cybersecurity and Information Security and who hears the administrative sanctioning proceedings, delegating their conduct but not the imposition of a sanction.
Article 53 applies the Ley de Ciberseguridad y Seguridad de la Informacion's sanctioning procedure and prescription rules to this Law's infractions. Article 54 puts the burden of proving consent or delivery of the privacy notice on the responsible party, and the burden of proving a lawful international transfer on the party that transferred the data. Article 55 requires ACE to publish every sanctioning resolution on its website, in a version with personal data dissociated or anonymized.
Article 56 classifies infractions as minor, such as failing to inform a data subject of their rights, not publishing the processor's contact details, failing to notify a breach, unauthorized database access, inaccurate processing, altering an authorization document, charging for a free service, breaching the information or public sector notice duties, or ignoring an ACE request, serious, such as incomplete or inaccurate access responses, unanswered ARCO POL requests, repurposed processing, obstructing an ACE audit, ignoring ACE technical measures, breaching the article 59 prohibitions, or ignoring ACE security policies, and very serious, such as processing without prior consent, denying ARCO POL requests, using a child's data without parental consent, processing an incapacitated person's data without consent, an unlawful international transfer, an unconsented transfer, commercializing personal data, reversing pseudonymization, processing after a revoked consent, or ignoring a valid revocation.
Article 57 fines a minor infraction one to ten, a serious infraction eleven to twenty five, and a very serious infraction twenty six to forty monthly minimum wages of the commercial sector. Article 58 lets ACE order remedial measures on top of a fine and preserves the infractor's civil or criminal liability.
Article 59 bars a responsible party from creating a sensitive data database unlawfully, processing racial, ethnic, political, religious, health, or sexual orientation data outside this Law's sensitive data rules, disclosing personal data learned through one's position, or using, transferring, sharing or commercializing personal data in violation of this Law.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .