El Salvador

Summary

El Salvador enacted its first comprehensive data protection law in November 2024 (Decreto Legislativo No. 144 — Ley para la Protección de Datos Personales, published 15-Nov-2024, in force 23-Nov-2024), simultaneously with a Cybersecurity and Information Security Law (Decreto No. 143, same dates). The Library of Congress Global Legal Monitor (January 2025) and BLP Legal confirm both laws' enactment. The data protection regulator is the newly created Agencia de Ciberseguridad del Estado (ACE), which also oversees cybersecurity policy. ACE received a $12 million budget for 2025 (approved by the Legislative Assembly, April 2025) and is actively being stood up with 90 permanent positions. Decreto 144 includes a publicly-available-data exemption: prior informed consent is not required where information is publicly available, inter alia. The Código Penal Art. 187 criminalises disclosure of confidential information; computer crimes are addressed in Decreto 143. Copyright is governed by Decreto Legislativo No. 604 (Ley de Propiedad Intelectual, 1993) — closed exceptions, no TDM exception, no sui generis database right. Because the DP law and cybersecurity regime are so new and implementing regulations are still developing, the full operational scope is fast-moving; the baseline legal framework is now determinable.