El SalvadorLey Especial contra los Delitos Informáticos y Conexos, acceso indebido a sistemas informáticos
Decreto Legislativo No. 260, art. 4
In force.
A computer misuse rule binding public and private bodies.
- Criminal exposure
- Yes
- Criminal exposure note
- Imprisonment of one to four years on conviction (art. 4).
- How the hook was established
- express
- What makes it apply
- User location, Place of effect
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, intercept or use a computer system without authorization, or by exceeding the authorization you were granted.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Article 4 makes it an offence to access, intercept or use an information system intentionally and without authorization or beyond the authorization granted (English: whoever intentionally and without authorization, or exceeding the one granted, accesses, intercepts or uses in whole or in part a computer system using information or communication technologies shall be punished with one to four years in prison). It imposes no duty to create, keep, produce or review a log or record. Article 15 of the Act, outside the cited article, punishes platform administrators who disable, alter, hide or destroy data held in an access or use record, and the row does not take its text. Article 2 is the Act's own scope clause: it applies to punishable acts committed wholly or partly in the national territory and to offences that affect legal interests of the State or its inhabitants, so it reaches the article 4 offence. Its further limb for information technology installed in the territory turns on where the system sits and carries no hook value.
- Kind
- None
- As of
What this law does
Article 4 punishes with one to four years' imprisonment anyone who intentionally and without authorization, or exceeding the authorization granted, accesses, intercepts or uses in whole or in part a computer system using information and communication technologies. The article carries no requirement that the offender defeat a security measure to reach the system, and its text does not say whether reading a public, unauthenticated page falls inside or outside 'sin autorización'.
The decree has since been amended twice, by Decreto Legislativo No. 236 (2021) and Decreto Legislativo No. 332 (2025); the text consulted is the consolidated version carrying both reform notes. It was sanctioned by the President on ; its vigencia article provides that it comes into force eight days after publication in the Diario Oficial, and no official source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .