El SalvadorLey para la Protección de Datos Personales, cross border transfer of personal data
Decreto Legislativo No. 144, arts. 41, 44 and 45 (international transfer of personal data)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data internationally, sign a contract with the receiving party that holds it to at least the same personal data protection obligations you carry.NIST Privacy FrameworkID.DE-P3
- Before transferring personal data to another country or international organization, confirm the receiving country meets at minimum this Law's data protection principles or applicable international standards, and take appropriate measures to secure the data at the point of transfer if the receiving country's protection is not adequate.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkPR.DS-P2
- Obtain the data subject's prior consent before an international transfer of their personal data, unless a reciprocal treaty exception applies or the transfer falls under a Central American Economic Integration treaty.NIST Privacy FrameworkCT.PO-P2
- Report your cross border personal data flows to the Entidad Rectora together with the transfer information and your database's registration.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P2Data-in-transit are protected.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 41, 44 and 45 require a contract with the receiving party, a receiving country that meets the Law's principles and the data subject's prior consent, and they have the controller make each cross-border flow known to the Entidad Rectora with the transfer information and the database registration. That report is a filing with the authority, not a record the controller keeps, and none of the three articles requires a log, an audit or a retention period. The burden of proving a transfer lawful is in Article 54, which this row does not cite and which is coded on the enforcement row. The cited articles state no territorial test.
- Kind
- None
- As of
What this law does
Article 41 requires the party transferring personal data to sign a contract with the receiving responsible party that binds the recipient to at least the same obligations the transferring party carries.
Article 44 permits any transfer of personal data to another country or international organization only where the receiving or importing country meets at minimum this Law's data protection principles or applicable international standards, never lower than El Salvador's own legal requirements, and requires the transferring party to guarantee this Law's standard is met where the receiving country's protection is not adequate, while exempting transfers made under Central American Economic Integration treaties and always requiring the data subject's prior consent absent a reciprocal treaty exception.
Article 45 lets a responsible party ask the Entidad Rectora for an opinion on whether its cross border data flow complies with this Law, and requires every cross border data flow to be reported to the Entidad Rectora together with the information needed for the transfer and the database's registration.
When LexLint raises it
When your app profile says your app ships a mobile app, distributes a software product or processes personal data.
Back to the example · Lint your app
Page updated .