El SalvadorCybersecurity and Information Security Law, Incident Reporting and Notice to Those Affected
Ley de Ciberseguridad y Seguridad de la Información Decreto Legislativo No. 143, 12 de noviembre de 2024, arts. 6(f), 6(h), 6(l), 8(h) y 21(a)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds an entity that administers public resources, carries out acts of public administration or has an incidence on the nation's critical infrastructure, whatever its form, nature or legal status, so it reaches a private owner or operator of a system that supports an essential service to the public (reached by declaring that you operate an essential service). The Agencia de Ciberseguridad del Estado qualifies the operators of critical infrastructure by reasoned resolution ratified by the President of the Republic (articles 2 and 8).
- Apply immediately and effectively the measures needed to prevent, report and resolve cybersecurity and information-security threats (article 6(f)).
- Send the competent authority, in the time, form and specificity it sets, the cybersecurity and information-security reports it requires (article 6(h)).
- When the Agencia determines it, inform the people who may be affected, as far as they can be identified, about an incident that could seriously compromise their information and about the measures they can take, through the means the Agencia sets (article 6(l)).
- After an incident, deliver to the potentially affected persons or to the investigating authorities truthful, sufficient and timely information about it when the Agencia requires you to (article 8(h)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Agencia de Ciberseguridad del Estado, which administers the National Registry of Cybersecurity Threats and Incidents and sanctions a late or non-conforming incident report as a very serious infraction (articles 8 and 21).
Settledness
- As of
- Open questions
- What time limit will the Agencia set for the reports it requires under article 6(h) of the Law?
What this law does
Article 6 requires each obligated entity to apply immediately and effectively the measures needed to prevent, report and resolve cybersecurity and information-security threats. Article 6 requires each obligated entity to submit to the competent authority, in the time, form and specificity it requires, the reports on cybersecurity and information security.
Article 6 requires an obligated entity, when the Agencia determines it, to inform the potentially affected persons about incidents that may seriously compromise their information. Article 8 empowers the Agencia to create and administer a National Registry of Cybersecurity Threats and Incidents.
Article 8 empowers the Agencia to require an entity that has suffered an incident to deliver truthful, sufficient and timely information about it to the potentially affected persons or the investigating authorities. Article 21 classes the late submission of a report that relates to an incident as a very serious infraction. Article 24 sets, for a private-sector infractor of a very serious infraction, a fine of fifty-one to one hundred monthly minimum wages of the commerce sector. Article 32 provides that the Law enters into force eight days after its publication in the Diario Oficial.
When LexLint raises it
When your app profile says your app runs an essential service.