Support Centre

El Salvador


Law: There is no general data protection law.

Regulator: There is no general data protection regulator.

Summary: The Law on Protection of Personal Data and Habeas Data ('the Law') was vetoed, on 7 May 2021, by the President on grounds of inconvenience, and was permanently archived, on 20 May 2021, by the Commission of Economy of the Legislative Assembly. The Law would have provided for, among other things, data subject rights of access, rectification, cancellation, and opposition, as well as the imposition of obligations on the security of personal data for private and public entities, specifically through the issuance of a confidentiality notice to the owner of personal data by electronic or physical means.

Currently, a patchwork of provisions, regulations, laws, and judicial decisions support a general framework for personal data protection. For instance, the Constitution of the Republic of El Salvador (only available in Spanish here) guarantees the right to life, physical and moral integrity, liberty, security, work, property and possession, among other things. In addition, the Consumer Protection Law as amended in 2018 (only available in Spanish here) regulates the financial sector and e-commerce, and outlines data security and confidentiality obligations in relation to consumer personal information.