El Salvador

Article 3 applies the law to any natural or legal person, regardless of nationality, autonomy or form of incorporation, that develops or provides services relating to the development, research or application of AI or similar technologies in El Salvador.

Article 7 creates the Agencia Nacional de Inteligencia Artificial (ANIA), an autonomous institution attached to the Presidency, and article 16 conditions the safeguards of article 19 (protection from injunctions against open-domain-data uses, liability limits for good-faith research and sandbox activity, and non-restrictive licensing for AI models) on registering in the Registro Nacional de Desarrollo, Innovación y Aplicación de IA.

Article 17 requires ANIA to set a comprehensive risk-evaluation framework, but makes compliance mandatory only for systems that handle data classified as confidential, reserved or personal. Article 27 required ANIA to issue the technical security criteria and the registration procedure within ninety days of the law's entry into force.

Article 22 requires that any use of personal data in AI development, research or application follow the Ley para la Protección de Datos Personales, under ANIA and ACE supervision.

Article 11 defines a 'Decisión Consecuencial' as one where an AI system, as the controlling factor, materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and requires an operator to register with ANIA when its AI system meets that test and is deployed in specified sectors, including primary health diagnosis or treatment, creditworthiness or loan and insurance approval, real-time biometric identification in public spaces, the exercise of government authority or the grant or denial of public benefits, unsupervised hiring or compensation decisions, and academic admission or grading.

Article 23 offers a supervised twelve-month sandbox with a sanctions grace period, and articles 20 to 22 recognize ISO/IEC, NIST and IEEE standards as creating a rebuttable presumption of conformity. Article 30 provides the disposition takes effect eight days after publication in the Diario Oficial, but the located text of the resolution does not state that publication date.

Article 18 requires that when AI is used commercially, or to access rights or services within the Republic, the user must be told whether the decision was adopted directly by the AI or was AI-driven, with a notification that gives a comprehensible and transparent explanation of the process.

The same article requires establishing a mechanism to challenge the decision before a competent natural person who can confirm, modify or revoke it, and makes compliance with the article a precondition for the safeguards Decreto Legislativo No. 234 otherwise grants a registered developer or operator.

Article 24 requires any entity using an AI system to make a decision affecting a person in El Salvador to notify them, independent of whether the entity is subject to registration, whenever the decision was made without meaningful human review and negatively affects the person's rights or economic situation in health, financial services, employment, education, government benefits, housing, or transportation.

The notification must be clear and understandable and must at minimum confirm that AI was involved, explain the role it played, and provide a mechanism to challenge the decision. Article 25 exempts the duty where disclosure would undermine fraud detection or cybersecurity, support law enforcement or national-security functions, or where the AI's role is limited to content recommendation, search results, advertising optimization, or basic spellcheck and grammar assistance.

Article 25 requires a responsible party, on learning of a personal data breach in any phase of processing, meaning any damage, loss, alteration, destruction, illegitimate access, or other unlawful or unauthorized use of personal data, including an accidental one, to notify the Agencia de Ciberseguridad del Estado, the Fiscalia General de la Republica, and the affected data subjects, within a maximum period of seventy two hours from becoming aware of the breach.

Within that same seventy two hours the responsible party must begin a thorough review to gauge the breach's magnitude, adopt corrective and preventive measures, and update its security policies.

The notification to the Entidad Rectora must be in clear, simple language and state the incident's nature, the personal data compromised, the immediate corrective actions taken, recommendations to the data subject, and where the data subject can learn more, while the notification to affected data subjects need only carry the incident's nature, the data compromised, the recommendations, and where to learn more.

The responsible party must also document every breach that risks the security of personal data, noting at least its date, cause, related facts, effects, and the corrective measures taken, and keep that record available to the supervisory authority.

Article 1 sets the Law's object as regulating the lawful and informed treatment of personal data to guarantee the right to privacy and informational self determination, and article 2 binds any natural or legal person, public or private, that processes personal data manually, partially or fully automated, or through a third party, including one that processes personal data without meeting this Law's requirements, while subjecting organs of the State and municipal authorities specifically to Title III.

Article 3 excludes credit history data already regulated by its own statute, except for financial system supervised entities' non credit data, purely personal or domestic processing, public safety and criminal justice processing, and processing under the civil registry and national identity document statutes.

Article 5 states ten governing principles: accuracy, loyalty, consent and purpose, data minimization, transparency in plain language, security, a six ground lawful basis test built on consent, contractual necessity, a legal obligation, vital interests, public interest, or legitimate interest, storage limitation, demonstrated accountability, and progressive exercise of children's faculties.

Article 26 requires consent to be express, given verbally, in writing, or through unequivocal signs recorded by a physical, electronic, or other technological means, and article 27 requires that consent to be free, specific, informed, express, and individualized.

Article 28 excuses consent for personal data from a publicly accessible source that is not sensitive, medical emergencies, dissociated data, missing persons, contractual or scientific relationships, data the data subject has already made public, and historical or scientific archives, and articles 29 to 31 let a data subject revoke consent at any time without retroactive effect, require the delegate to act on a revocation within five business days, and let a data subject complain to the Entidad Rectora over a refused revocation.

Article 32 confines a private entity's processing to data directly related to the services it provides that data subject, and bars transferring or processing a third party's data for another purpose without that party's authorization. Article 33 requires a documented ARCO POL procedure and requires any subcontractor with access to personal data to submit to this Law.

Article 34 requires the responsible party to limit processing to the purpose consented to, implement security measures, and keep the data confidential, and article 36 requires the responsible party and any processor to maintain the security measures the Entidad Rectora sets for integrity, availability, and confidentiality. Article 40 conditions any transfer of personal data on the data subject's prior consent, informed of the transfer's purpose and the identity of the recipient.

Title III's articles 46 to 49 let a public body process personal data within its legal competence without the data subject's consent, while preserving a narrower set of ARCO POL rights, an information duty, and a bar on transferring or disseminating the data outside listed exceptions. Article 64 brings the decree into force eight days after its publication in the Diario Oficial, following its 12 November 2024 adoption and 15 November 2024 Diario Oficial publication.

Article 41 requires the party transferring personal data to sign a contract with the receiving responsible party that binds the recipient to at least the same obligations the transferring party carries.

Article 44 permits any transfer of personal data to another country or international organization only where the receiving or importing country meets at minimum this Law's data protection principles or applicable international standards, never lower than El Salvador's own legal requirements, and requires the transferring party to guarantee this Law's standard is met where the receiving country's protection is not adequate, while exempting transfers made under Central American Economic Integration treaties and always requiring the data subject's prior consent absent a reciprocal treaty exception.

Article 45 lets a responsible party ask the Entidad Rectora for an opinion on whether its cross border data flow complies with this Law, and requires every cross border data flow to be reported to the Entidad Rectora together with the information needed for the transfer and the database's registration.

Article 6 gives every data subject the right to know whether their personal data is being processed, to seek its rectification, cancellation or blocking, to object to its processing, to limit future processing to the uses they consented to, to obtain an intelligible copy of their data, and to transfer it, rights their heirs or successors may exercise once the data subject has died.

Article 7 requires a responsible party, including a third party cloud or storage provider it engages, to tell a data subject before collecting their data the purpose, the intended recipients, the existence and safeguards of the database, contact details for the responsible party and its delegate, the content of ARCO POL rights, and the security measures in place, free of charge and revised when the purpose changes.

Article 8 gives a free right of access to a data subject's own information, in clear language without codes, complete unless pseudonymized or dissociated, without revealing a third party's data, and telling the data subject whether their information was shared with other institutions. Article 9 gives a right to rectification within twenty business days, blocking the data under review in the meantime, and lets an unmet deadline ground a complaint to the Entidad Rectora.

Article 10 gives a right to erasure without undue delay on the listed grounds, including withdrawn consent, unlawful processing, a legal duty to erase, or data obtained for direct offers to children, subject to listed exceptions, and includes a right to be forgotten reaching search engine delisting and notice to other responsible parties holding the same data.

Article 11 lets erasure or cancellation instead block the data, keeping it available only to public administration, judges or courts for liabilities arising from the processing. Article 12 gives a right to object to processing, including profiling for commercial or direct marketing purposes, subject to listed exceptions including a child data subject. Article 13 gives a right to limit processing while accuracy or lawfulness is disputed, needed for a claim, or objected to pending review.

Article 14 gives a right to portability, in a structured, commonly used, machine readable and interoperable format, where processing rests on consent and is carried out by automated means.

Articles 15 to 20 require the responsible party to appoint a delegate who manages ARCO POL requests, publishes the privacy notice, and answers a request within twenty business days extendable once by another twenty for justified cause, referring an incompetent request within five business days and curing an incomplete one within ten.

Article 21 fixes how information is delivered and requires the delegate to notify anyone who received data of its later rectification, update or deletion within five business days of granting the request. Article 22 lists the grounds on which a delegate may deny an ARCO POL request, each requiring a reasoned written notice within three business days. Article 23 makes exercising ARCO POL rights free beyond reproduction, certification or delivery costs.

Article 24 requires a privacy notice, consistent with the responsible party's privacy policy, stating the responsible party's address, which data are sensitive, the legal basis, the purposes, the mechanisms for exercising ARCO POL rights and revoking consent, the delegate's contact details, how changes will be communicated, any subcontracted processor's contact details, and cookie use, communicated in writing before the data subject consents.

Articles 46 to 48 preserve for a public body's data subject the rights of access, rectification, a narrower ground for cancellation, objection, and a narrower ground for limitation, exercised through the same procedure as the private sector, and require the public body to tell its users that their data may be collected and processed and how to reach the delegate.

Article 35 gives the Entidad Rectora, the Agencia de Ciberseguridad del Estado (ACE), power to dictate mandatory policies for managing personal data.

Article 50 lists ACE's attributes, among them supervising and inspecting obligated institutions, exercising sanctioning power, issuing provisional measures, promoting public awareness, resolving disputes over sensitive data classification, supporting responsible parties technically, cooperating with other supervisory authorities, issuing operating policies and security measures, certifying data protection compliance and auditing those certifications yearly, training public and private institutions, publishing implementation guides, and requesting information from public and private entities.

Article 51 gives the ACE Director General these powers except the power to sanction, which a separately appointed Director of Data Protection exercises through delegated administrative sanctioning proceedings, and article 52 sets that Director's qualifications. Article 53 applies the Ley de Ciberseguridad y Seguridad de la Informacion's sanctioning procedure and prescription rules to this Law's infractions.

Article 54 puts the burden of proving consent or delivery of the privacy notice on the responsible party, and the burden of proving a lawful international transfer on the party that transferred the data. Article 55 requires ACE to publish every sanctioning resolution on its website, in a version with personal data dissociated or anonymized.

Article 56 classifies infractions as minor, such as failing to inform a data subject of their rights, not publishing the processor's contact details, failing to notify a breach, unauthorized database access, inaccurate processing, altering an authorization document, charging for a free service, breaching the information or public sector notice duties, or ignoring an ACE request, serious, such as incomplete or inaccurate access responses, unanswered ARCO POL requests, repurposed processing, obstructing an ACE audit, ignoring ACE technical measures, breaching the article 59 prohibitions, or ignoring ACE security policies, and very serious, such as processing without prior consent, denying ARCO POL requests, using a child's data without parental consent, processing an incapacitated person's data without consent, an unlawful international transfer, an unconsented transfer, commercializing personal data, reversing pseudonymization, processing after a revoked consent, or ignoring a valid revocation.

Article 57 fines a minor infraction one to ten, a serious infraction eleven to twenty five, and a very serious infraction twenty six to forty monthly minimum wages of the commercial sector. Article 58 lets ACE order remedial measures on top of a fine and preserves the infractor's civil or criminal liability.

Article 59 bars a responsible party from creating a sensitive data database unlawfully, processing racial, ethnic, political, religious, health, or sexual orientation data outside this Law's sensitive data rules, disclosing personal data learned through one's position, or using, transferring, sharing or commercializing personal data in violation of this Law.

Article 4(g) defines sensitive personal data as data touching a person's physical or moral characteristics or facts of their private life whose misuse could cause discrimination or gravely harm their honor, personal or family privacy, or image, naming religious belief, ethnic origin, political affiliation, union affiliation, sexual preference, physical and mental health, and biometric or genetic information among the enumerated examples.

Article 26's last paragraph requires a responsible party to obtain a sensitive data subject's written consent, by an autograph signature or its equivalent, a heightened standard above the ordinary consent article 26's first paragraph sets, and its second paragraph applies the Progressive Exercise of Faculties principle to a child's consent to provide personal data.

Article 37 bars compelling anyone to provide sensitive personal data, conditions its processing on the data subject's express and unequivocal consent after being told of the right to withhold it, and excuses that consent only to safeguard the life of an incapacitated data subject or another person, or where a health professional or an equivalently bound person processes health data for prevention, diagnosis, treatment, or health service management under professional secrecy.

Article 38 limits collecting and processing sensitive personal data to cases this Law authorizes, cases of general interest another statute authorizes, a legal mandate, or statistical or scientific purposes once the data have been dissociated from the data subject. Article 39 lets a health establishment or health professional collect and treat a patient's physical or mental health data, respecting professional secrecy, patient rights legislation, and this Law.

Article 42 requires every kind of processing to guarantee the best interests of children and adolescents, to inform both the child and their parents or guardians of the processing before exercising the child's rights, and to present that information in clear, simple, age appropriate language.

Article 4 punishes with one to four years' imprisonment anyone who intentionally and without authorization, or exceeding the authorization granted, accesses, intercepts or uses in whole or in part a computer system using information and communication technologies.

The article carries no requirement that the offender defeat a security measure to reach the system, unlike a statute conditioning the offence on infringing a technical control, so whether reading a public, unauthenticated page falls inside or outside 'sin autorización' turns on a reading no reported Salvadoran decision has settled.

The decree has since been amended twice, by Decreto Legislativo No. 236 (2021) and Decreto Legislativo No. 332 (2019); the text consulted is the consolidated version carrying both reform notes. It was sanctioned by the President on 26 February 2016; the located text does not state the Official Gazette publication date needed to compute the exact eight-day commencement date its own vigencia article sets.

Article 308 prohibits evading, without authorization, an effective technological measure that controls access to a protected work, performance, execution or phonogram, and prohibits manufacturing, importing, distributing, offering or providing to the public a technology, product, service or device designed for that purpose. The article carries listed exceptions, including good-faith activity by a computer, system or network owner testing or correcting its own security.

This provision reaches circumventing a technical access control placed on copyrighted material, a narrower question than the general unauthorized-access offence in the Ley Especial contra los Delitos Informáticos y Conexos.

The Intellectual Property Law contains no text-and-data-mining exception and no machine-readable opt-out mechanism of the kind the European Union's 2019 Digital Single Market Directive creates; no occurrence of that concept appears in the Act's text.

The closest analogues are narrower: article 45 permits, without authorization or remuneration, a single personal copy of an already-divulged work made by the user with their own means, and a reprographic copy for teaching or examinations at a non-profit educational institution, in the measure the purpose justifies and in accordance with fair practice; article 46 permits including brief fragments of a lawfully divulged protected work in another work, without remuneration or authorization, for quotation, criticism, illustration, teaching or research, provided the source, title and author are named.

Neither exception is scoped to, or large enough to cover, systematic reproduction of copyrighted text for training a model.

Article 17 protects, without prejudice to rights in an underlying work, anthologies or compilations of diverse works or of data or other materials, including databases in machine-readable form, where the selection or arrangement of the materials constitutes an original creation.

The article confers no sui generis right in the data or contents themselves; protection turns on the originality of the selection or arrangement, the same standard the copyright chapter applies to any other compiled work.

The Intellectual Property Law (Decreto Legislativo No. 66) replaced the 1993 Ley de Propiedad Intelectual (Decreto Legislativo No. 604, as amended) and entered into force six months after its 15 August 2024 publication in the Diario Oficial, per its own article 340 and WIPO Lex's record of that law.

Article 47(a) permits, without the author's authorization or remuneration, provided the author's name and the source are indicated, the reproduction and distribution by the press, or transmission by any medium, of current-events articles on economic, social, artistic, political or religious matters published in the media, unless the reproduction or transmission has been expressly reserved.

Article 47(b) and (c) extend the same treatment to images or sounds of a current event captured in the course of reporting it, and to speeches, addresses and similar public remarks reported as news, in each case only to the extent the informational purpose justifies.

Article 46 separately permits including brief fragments of an already lawfully divulged protected work in another work, without remuneration or the rightholder's authorization, where the inclusion is by way of quotation or for criticism, illustration, teaching or research, and the source, title and author are named.

Neither provision carries a headline-length or short-extract cap distinct from these purpose-bound tests, and no reported Salvadoran decision applies either to a systematic news aggregator rather than an individual press outlet or writer quoting a published work.