El Salvador

Article 3 applies the law to any natural or legal person, regardless of nationality, autonomy or form of incorporation, that develops or provides services relating to the development, research or application of AI or similar technologies in El Salvador.

Article 7 creates the Agencia Nacional de Inteligencia Artificial (ANIA), an autonomous institution attached to the Presidency, and article 16 conditions the safeguards of article 19 (protection from injunctions against open-domain-data uses, liability limits for good-faith research and sandbox activity, and non-restrictive licensing for AI models) on registering in the Registro Nacional de Desarrollo, Innovación y Aplicación de IA.

Article 17 requires ANIA to set a comprehensive risk-evaluation framework, but makes compliance mandatory only for systems that handle data classified as confidential, reserved or personal. Article 27 required ANIA to issue the technical security criteria and the registration procedure within ninety days of the law's entry into force.

Article 22 requires that any use of personal data in AI development, research or application follow the Ley para la Protección de Datos Personales, under ANIA and ACE supervision. Article 29 brings the decree into force eight days after its publication in the Diario Oficial. Resolución 0001/2025 records that publication in Diario Oficial number 43, Tomo 446, of 3 March 2025, and no source stating the resulting day of entry into force has been located.

Article 4(e) defines a 'Decisión Consecuencial' as one where an AI system, as the controlling factor, materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and Article 11 requires an operator to register with ANIA when its AI system meets that test and is deployed in specified sectors, including primary health diagnosis or treatment, creditworthiness or loan and insurance approval, real-time biometric identification in public spaces, the exercise of government authority or the grant or denial of public benefits, unsupervised hiring or compensation decisions, and academic admission or grading.

Article 23 offers a supervised twelve-month sandbox with a sanctions grace period, and articles 21 and 22 recognize ISO/IEC, National Institute of Standards and Technology (NIST) and IEEE standards as creating a rebuttable presumption of conformity. Article 30 provides the disposition takes effect eight days after publication in the Diario Oficial, and no official source stating the day it came into force has been located.

Article 18 requires that when AI is used commercially, or to access rights or services within the Republic, the user must be told whether the decision was adopted directly by the AI or was AI-driven, with a notification that gives a comprehensible and transparent explanation of the process.

The same article requires establishing a mechanism to challenge the decision before a competent natural person who can confirm, modify or revoke it, and makes compliance with the article a precondition for the safeguards Decreto Legislativo No. 234 otherwise grants a registered developer or operator. Article 29 brings the decree into force eight days after its publication in the Diario Oficial.

Resolución 0001/2025 records that publication in Diario Oficial number 43, Tomo 446, of 3 March 2025, and no source stating the resulting day of entry into force has been located.

Article 24 requires any entity using an AI system to make a decision affecting a person in El Salvador to notify them, independent of whether the entity is subject to registration, whenever the decision was made without meaningful human review and negatively affects the person's rights or economic situation in health, financial services, employment, education, government benefits, housing, or transportation.

The notification must be clear and understandable and must at minimum confirm that AI was involved, explain the role it played, and provide a mechanism to challenge the decision. Article 25 exempts the duty where disclosure would undermine fraud detection or cybersecurity, support law enforcement or national-security functions, or where the AI's role is limited to content recommendation, search results, advertising optimization, or basic spellcheck and grammar assistance.

Article 30 provides the resolution takes effect eight days after publication in the Diario Oficial, and no official source stating the day it came into force has been located.

Article 25 requires a responsible party, on learning of a personal data breach in any phase of processing, meaning any damage, loss, alteration, destruction, illegitimate access, or other unlawful or unauthorized use of personal data, including an accidental one, to notify the Agencia de Ciberseguridad del Estado, the Fiscalia General de la Republica, and the affected data subjects, within a maximum period of seventy two hours from becoming aware of the breach.

Within that same seventy two hours the responsible party must begin a thorough review to gauge the breach's magnitude, adopt corrective and preventive measures, and update its security policies.

The notification to the Entidad Rectora must be in clear, simple language and state the incident's nature, the personal data compromised, the immediate corrective actions taken, recommendations to the data subject, and where the data subject can learn more, while the notification to affected data subjects need only carry the incident's nature, the data compromised, the recommendations, and where to learn more.

The responsible party must also document every breach that risks the security of personal data, noting at least its date, cause, related facts, effects, and the corrective measures taken, and keep that record available to the supervisory authority.

Article 1 sets the Law's object as regulating the lawful and informed treatment of personal data to guarantee the right to privacy and informational self determination, and article 2 binds any natural or legal person, public or private, that processes personal data manually, partially or fully automated, or through a third party, including one that processes personal data without meeting this Law's requirements, while subjecting organs of the State and municipal authorities specifically to Title III.

Article 3 excludes credit history data already regulated by its own statute, except for financial system supervised entities' non credit data, purely personal or domestic processing, public safety and criminal justice processing, and processing under the civil registry and national identity document statutes.

Article 5 states ten governing principles: accuracy, loyalty, consent and purpose, data minimization, transparency in plain language, security, a six ground lawful basis test built on consent, contractual necessity, a legal obligation, vital interests, public interest, or legitimate interest, storage limitation, demonstrated accountability, and progressive exercise of children's faculties.

Article 26 requires consent to be express, given verbally, in writing, or through unequivocal signs recorded by a physical, electronic, or other technological means, and article 27 requires that consent to be free, specific, informed, express, and individualized.

Article 28 excuses consent for personal data from a publicly accessible source that is not sensitive, medical emergencies, dissociated data, missing persons, contractual or scientific relationships, data the data subject has already made public, and historical or scientific archives. Articles 29 and 31 let a data subject revoke consent at any time without retroactive effect and complain to the Entidad Rectora over a refused revocation.

Article 30 as amended requires the obligated party to act on a revocation within five business days. Article 32 confines a private entity's processing to data directly related to the services it provides that data subject, and bars transferring or processing a third party's data for another purpose without that party's authorization. Article 33 requires a documented ARCO POL procedure and requires any subcontractor with access to personal data to submit to this Law.

Article 34 requires the responsible party to limit processing to the purpose consented to, implement security measures, and keep the data confidential, and article 36 requires the responsible party and any processor to maintain the security measures the Entidad Rectora sets for integrity, availability, and confidentiality. Article 40 conditions any transfer of personal data on the data subject's prior consent, informed of the transfer's purpose and the identity of the recipient.

Title III's articles 46 to 49 let a public body process personal data within its legal competence without the data subject's consent, while preserving a narrower set of ARCO POL rights, an information duty, and a bar on transferring or disseminating the data outside listed exceptions. Article 64 brings the decree into force eight days after its publication in the Diario Oficial, following its 12 November 2024 adoption and 15 November 2024 Diario Oficial publication.

Legislative Decree 659 of 17 September 2026 amended articles 2, 16, 18 to 22, 24, 30, 47, 48 and 51 of the Law and repealed articles 15 and 17. Legislative Decree 659 was published in the Diario Oficial, number 173, Tomo 452, on 18 September 2026. Legislative Decree 659 entered into force eight days after that publication, on 26 September 2026.

Article 41 requires the party transferring personal data to sign a contract with the receiving responsible party that binds the recipient to at least the same obligations the transferring party carries.

Article 44 permits any transfer of personal data to another country or international organization only where the receiving or importing country meets at minimum this Law's data protection principles or applicable international standards, never lower than El Salvador's own legal requirements, and requires the transferring party to guarantee this Law's standard is met where the receiving country's protection is not adequate, while exempting transfers made under Central American Economic Integration treaties and always requiring the data subject's prior consent absent a reciprocal treaty exception.

Article 45 lets a responsible party ask the Entidad Rectora for an opinion on whether its cross border data flow complies with this Law, and requires every cross border data flow to be reported to the Entidad Rectora together with the information needed for the transfer and the database's registration.

The credit-history law, Decreto Legislativo No. 695 of 2011, gives a consumer or client who proves their identity the right to know whether information on their credit history is being processed and to obtain a copy. The credit-history law gives the consumer the right to have records that are unlawful, erroneous, unjustified or inaccurate rectified or deleted.

The credit-history law lets a consumer or client exercise the rights of access, rectification, modification and cancellation before the economic agent, the data information agency, the financial system supervisor or the consumer ombudsman. The credit-history law requires the economic agent or data information agency to answer a consumer's request within five business days.

The credit-history law lets a consumer turn to the consumer ombudsman when the five business days pass without an answer or the answer does not satisfy them. The credit-history law treats ignoring a consumer's request for access, rectification, modification or cancellation as a grave infraction. The credit-history law punishes a grave infraction with a fine of one hundred to three hundred monthly urban commerce and services minimum wages.

The credit-history law forbids an information agency to use, transfer, share or market a person's data in its database without the express consent of the person. The decree was published in Diario Oficial No. 141, Tomo 392, on 27 July 2011. The decree entered into force ninety days after its publication in the Diario Oficial.

Article 6 gives every data subject the right to know whether their personal data is being processed, to seek its rectification, cancellation or blocking, to object to its processing, to limit future processing to the uses they consented to, to obtain an intelligible copy of their data, and to transfer it, rights their heirs or successors may exercise once the data subject has died.

Article 7 requires a responsible party, including a third party cloud or storage provider it engages, to tell a data subject before collecting their data the purpose, the intended recipients, the existence and safeguards of the database, contact details for the responsible party and its processor, the content of ARCO POL rights, and the security measures in place, free of charge and revised when the purpose changes.

Article 8 gives a free right of access to a data subject's own information, in clear language without codes, complete unless pseudonymized or dissociated, without revealing a third party's data, and telling the data subject whether their information was shared with other institutions. Article 9 gives a right to rectification within twenty business days, blocking the data under review in the meantime, and lets an unmet deadline ground a complaint to the Entidad Rectora.

Article 10 gives a right to erasure without undue delay on the listed grounds, including withdrawn consent, unlawful processing, a legal duty to erase, or data obtained for direct offers to children, subject to listed exceptions, and includes a right to be forgotten reaching search engine delisting and notice to other responsible parties holding the same data.

Article 11 lets erasure or cancellation instead block the data, keeping it available only to public administration, judges or courts for liabilities arising from the processing. Article 12 gives a right to object to processing, including profiling for commercial or direct marketing purposes, subject to listed exceptions including a child data subject. Article 13 gives a right to limit processing while accuracy or lawfulness is disputed, needed for a claim, or objected to pending review.

Article 14 gives a right to portability, in a structured, commonly used, machine readable and interoperable format, where processing rests on consent and is carried out by automated means. Articles 15 and 17, which required each obligated party to appoint a delegate to manage ARCO POL requests and required its units and providers to assist that delegate, are repealed.

Article 16 as amended makes assisting and guiding the obligated party's units or providers in the exercise of ARCO POL rights an obligation of the obligated party itself. Article 18 as amended has a data subject file an ARCO POL request with the obligated party, which may ask once for an incomplete request to be cured within ten business days. Article 19 as amended requires the obligated party to return a request it is not competent to handle within five business days.

Article 20 as amended requires the obligated party to answer an ARCO POL request within twenty business days, extendable once by another twenty for justified cause. Article 21 fixes how information is delivered. As amended, article 21 requires the obligated party to notify anyone who received data of its later rectification, update or deletion within five business days of deciding that the request is proper.

Article 22 as amended lists the grounds on which an obligated party may deny an ARCO POL request, each requiring a reasoned written notice within three business days. Article 23 makes exercising ARCO POL rights free beyond reproduction, certification or delivery costs.

Article 24 requires a privacy notice, consistent with the responsible party's privacy policy, stating the responsible party's address, which data are sensitive, the legal basis, the purposes, the mechanisms for exercising ARCO POL rights and revoking consent, how changes will be communicated, any subcontracted processor's contact details, and cookie use, communicated in writing before the data subject consents.

Article 24(f) as amended requires the notice to indicate the means or mechanisms for submitting ARCO POL requests. Articles 46 to 48 preserve for a public body's data subject the rights of access, rectification, a narrower ground for cancellation, objection, and a narrower ground for limitation, exercised through the same procedure as the private sector.

Article 47 as amended requires a public institution to appoint a data protection delegate, who may be the institution's own Information Officer. Article 48 as amended requires the public body to tell its users that their data may be collected and processed and the means to exercise their rights.

Article 35 gives the Entidad Rectora, the Agencia de Ciberseguridad del Estado (ACE), power to dictate mandatory policies for managing personal data.

Article 50 lists ACE's attributes, among them supervising and inspecting obligated institutions, exercising sanctioning power, issuing provisional measures, promoting public awareness, resolving disputes over sensitive data classification, supporting responsible parties technically, cooperating with other supervisory authorities, issuing operating policies and security measures, certifying data protection compliance and auditing those certifications yearly, training public and private institutions, publishing implementation guides, and requesting information from public and private entities.

Article 51 gives the ACE Director General these powers except the power to sanction. Article 51 as amended has the President of the Republic appoint a Director of Data Protection to assist the Director General, for a three year term, who must meet the same requirements as ACE's Director of Cybersecurity and Information Security and who hears the administrative sanctioning proceedings, delegating their conduct but not the imposition of a sanction.

Article 53 applies the Ley de Ciberseguridad y Seguridad de la Informacion's sanctioning procedure and prescription rules to this Law's infractions. Article 54 puts the burden of proving consent or delivery of the privacy notice on the responsible party, and the burden of proving a lawful international transfer on the party that transferred the data. Article 55 requires ACE to publish every sanctioning resolution on its website, in a version with personal data dissociated or anonymized.

Article 56 classifies infractions as minor, such as failing to inform a data subject of their rights, not publishing the processor's contact details, failing to notify a breach, unauthorized database access, inaccurate processing, altering an authorization document, charging for a free service, breaching the information or public sector notice duties, or ignoring an ACE request, serious, such as incomplete or inaccurate access responses, unanswered ARCO POL requests, repurposed processing, obstructing an ACE audit, ignoring ACE technical measures, breaching the article 59 prohibitions, or ignoring ACE security policies, and very serious, such as processing without prior consent, denying ARCO POL requests, using a child's data without parental consent, processing an incapacitated person's data without consent, an unlawful international transfer, an unconsented transfer, commercializing personal data, reversing pseudonymization, processing after a revoked consent, or ignoring a valid revocation.

Article 57 fines a minor infraction one to ten, a serious infraction eleven to twenty five, and a very serious infraction twenty six to forty monthly minimum wages of the commercial sector. Article 58 lets ACE order remedial measures on top of a fine and preserves the infractor's civil or criminal liability.

Article 59 bars a responsible party from creating a sensitive data database unlawfully, processing racial, ethnic, political, religious, health, or sexual orientation data outside this Law's sensitive data rules, disclosing personal data learned through one's position, or using, transferring, sharing or commercializing personal data in violation of this Law.

Article 4(g) defines sensitive personal data as data touching a person's physical or moral characteristics or facts of their private life whose misuse could cause discrimination or gravely harm their honor, personal or family privacy, or image, naming religious belief, ethnic origin, political affiliation, union affiliation, sexual preference, physical and mental health, and biometric or genetic information among the enumerated examples.

Article 26's last paragraph requires a responsible party to obtain a sensitive data subject's written consent, by an autograph signature or its equivalent, a heightened standard above the ordinary consent article 26's first paragraph sets, and its second paragraph applies the Progressive Exercise of Faculties principle to a child's consent to provide personal data.

Article 37 bars compelling anyone to provide sensitive personal data, conditions its processing on the data subject's express and unequivocal consent after being told of the right to withhold it, and excuses that consent only to safeguard the life of an incapacitated data subject or another person, or where a health professional or an equivalently bound person processes health data for prevention, diagnosis, treatment, or health service management under professional secrecy.

Article 38 limits collecting and processing sensitive personal data to cases this Law authorizes, cases of general interest another statute authorizes, a legal mandate, or statistical or scientific purposes once the data have been dissociated from the data subject. Article 39 lets a health establishment or health professional collect and treat a patient's physical or mental health data, respecting professional secrecy, patient rights legislation, and this Law.

Article 42 requires every kind of processing to guarantee the best interests of children and adolescents, to inform both the child and their parents or guardians of the processing before exercising the child's rights, and to present that information in clear, simple, age appropriate language.

Article 4 punishes with one to four years' imprisonment anyone who intentionally and without authorization, or exceeding the authorization granted, accesses, intercepts or uses in whole or in part a computer system using information and communication technologies. The article carries no requirement that the offender defeat a security measure to reach the system, and its text does not say whether reading a public, unauthenticated page falls inside or outside 'sin autorización'.

The decree has since been amended twice, by Decreto Legislativo No. 236 (2021) and Decreto Legislativo No. 332 (2025); the text consulted is the consolidated version carrying both reform notes. It was sanctioned by the President on 26 February 2016; its vigencia article provides that it comes into force eight days after publication in the Diario Oficial, and no official source stating the day it came into force has been located.

Article 308 prohibits evading, without authorization, an effective technological measure that controls access to a protected work, performance, execution or phonogram, and prohibits manufacturing, importing, distributing, offering or providing to the public a technology, product, service or device designed for that purpose. The article carries listed exceptions, including good-faith activity by a computer, system or network owner testing or correcting its own security.

This provision reaches circumventing a technical access control placed on copyrighted material, a narrower question than the general unauthorized-access offence in the Ley Especial contra los Delitos Informáticos y Conexos.

The Intellectual Property Law contains no text-and-data-mining exception and no machine-readable opt-out mechanism of the kind the European Union's 2019 Digital Single Market Directive creates; no occurrence of that concept appears in the Act's text.

The closest analogues are narrower: article 45 permits, without authorization or remuneration, a single personal copy of an already-divulged work made by the user with their own means, and a reprographic copy for teaching or examinations at a non-profit educational institution, in the measure the purpose justifies and in accordance with fair practice; article 46 permits including brief fragments of a lawfully divulged protected work in another work, without remuneration or authorization, for quotation, criticism, illustration, teaching or research, provided the source, title and author are named.

Neither exception is scoped to, or large enough to cover, systematic reproduction of copyrighted text for training a model.

Article 17 protects, without prejudice to rights in an underlying work, anthologies or compilations of diverse works or of data or other materials, including databases in machine-readable form, where the selection or arrangement of the materials constitutes an original creation.

The article confers no sui generis right in the data or contents themselves; protection turns on the originality of the selection or arrangement, the same standard the copyright chapter applies to any other compiled work.

The Intellectual Property Law (Decreto Legislativo No. 66) replaced the 1993 Ley de Propiedad Intelectual (Decreto Legislativo No. 604, as amended) and entered into force six months after its 15 August 2024 publication in the Diario Oficial, per its own article 340 and WIPO Lex's record of that law.

Article 2 binds the organs of Government, official autonomous institutions and municipal authorities, and any other entity regardless of its form, nature or legal status that administers public resources, carries out acts of public administration or has an incidence on the nation's critical infrastructure.

Article 4 defines critical infrastructure as computer systems, equipment, networks or technological services that support the provision of essential services to the public and whose failure could have an impact on them. Article 8 empowers the Agencia de Ciberseguridad del Estado to qualify the operators of critical infrastructure by reasoned resolution subject to ratification by the President of the Republic.

Article 6 requires each obligated entity to implement a permanent cybersecurity and information-security management system to determine and mitigate the risks to its computer systems and infrastructure. Article 6 requires each obligated entity to draw up and implement operational-continuity and cybersecurity plans that the competent authority approves.

Article 21 classes the failure to implement a permanent cybersecurity and information-security management system, without justified cause, as a very serious infraction. Article 23 sets, for a private-sector infractor of a serious infraction, a fine of eleven to fifty monthly minimum wages of the commerce sector. Article 24 sets, for a private-sector infractor of a very serious infraction, a fine of fifty-one to one hundred monthly minimum wages of the commerce sector.

Article 32 provides that the Law enters into force eight days after its publication in the Diario Oficial. The Law was published in the Diario Oficial of 15 November 2024.

Article 1 sets the minimum criteria for the management of information security and cybersecurity, in line with each entity's nature, size, risk profile and volume of operations. Article 2 binds the banks established in El Salvador and the branches of foreign banks established in the country. Article 2 binds the insurance companies established in El Salvador and the branches of foreign insurance companies. Article 2 binds the e-money providers.

Article 10 requires each entity to establish, maintain and document an information security management system consistent with its business-continuity management and its operational-risk management. Article 12 requires each entity to implement a cybersecurity function that reports to the board, the risk committee and senior management. Article 32 provides that a breach of the NRP-23 is sanctioned under the Ley de Supervisión y Regulación del Sistema Financiero.

The preamble records that the Ley de Supervisión y Regulación del Sistema Financiero makes the Banco Central de Reserva responsible for approving the technical norms on risk management by supervised entities. The Comité de Normas amended article 2 in a session of 30 September 2025, with effect from 15 October 2025.

Article 1 regulates the cybersecurity measures of the financial entities through which the information on the financial products and services offered to clients in digital channels is collected, processed, transmitted and stored. Article 2 binds the banks established in El Salvador and the branches of foreign banks established in El Salvador.

Article 5 requires the entities to have vulnerability-management processes based on penetration tests and vulnerability scans, and to remediate or mitigate all security gaps and not only the critical and high-risk ones. Article 7 requires the entities to use multi-factor authentication on any user account that accesses through the Internet and on privileged accounts. Article 14 requires the entities to encrypt critical information at rest or in transit.

Article 18 requires the entities to have response plans to mitigate the impact of a cybersecurity incident and to test them. Article 41 provides that a breach of the NRP-32 is sanctioned under the Ley de Supervisión y Regulación del Sistema Financiero. Article 44 sets 8 March 2022 as the day the NRP-32 enters into force.

Article 6 requires each obligated entity to apply immediately and effectively the measures needed to prevent, report and resolve cybersecurity and information-security threats. Article 6 requires each obligated entity to submit to the competent authority, in the time, form and specificity it requires, the reports on cybersecurity and information security.

Article 6 requires an obligated entity, when the Agencia determines it, to inform the potentially affected persons about incidents that may seriously compromise their information. Article 8 empowers the Agencia to create and administer a National Registry of Cybersecurity Threats and Incidents.

Article 8 empowers the Agencia to require an entity that has suffered an incident to deliver truthful, sufficient and timely information about it to the potentially affected persons or the investigating authorities. Article 21 classes the late submission of a report that relates to an incident as a very serious infraction. Article 24 sets, for a private-sector infractor of a very serious infraction, a fine of fifty-one to one hundred monthly minimum wages of the commerce sector. Article 32 provides that the Law enters into force eight days after its publication in the Diario Oficial.

Article 13 requires an entity to establish notification procedures under which senior management and the Superintendencia are told, when the entity becomes aware of a materialized information-security or cybersecurity incident that exceeds the risk limits the board has approved, with a brief description of the incident. Article 13 requires the entity to send the complete documentation on the incident within seven working days after reporting it.

Article 13 requires the entity to inform in a timely way the clients and users of financial services affected by a cybersecurity incident that compromised the confidentiality or integrity of their information. Article 32 provides that a breach of the NRP-23 is sanctioned under the Ley de Supervisión y Regulación del Sistema Financiero. Article 37 sets 1 July 2020 as the day the NRP-23 enters into force.

Article 47(a) permits, without the author's authorization or remuneration, provided the author's name and the source are indicated, the reproduction and distribution by the press, or transmission by any medium, of current-events articles on economic, social, artistic, political or religious matters published in the media, unless the reproduction or transmission has been expressly reserved.

Article 47(b) and (c) extend the same treatment to images or sounds of a current event captured in the course of reporting it, and to speeches, addresses and similar public remarks reported as news, in each case only to the extent the informational purpose justifies.

Article 46 separately permits including brief fragments of an already lawfully divulged protected work in another work, without remuneration or the rightholder's authorization, where the inclusion is by way of quotation or for criticism, illustration, teaching or research, and the source, title and author are named.

Neither provision carries a headline-length or short-extract cap distinct from these purpose-bound tests, and no reported Salvadoran decision applies either to a systematic news aggregator rather than an individual press outlet or writer quoting a published work.