Personal data relation in El Salvador: how to prepare for the reform of the cybercrime law
The Salvadoran regulatory environment regarding digital matters has rapidly changed in recent months. Following the recent approval of the Personal Data Protection Law in November 2024, the reform of the Special Law Against Cybercrime and Related Crimes, effective from July 2025, has now been added. Both legal frameworks not only coexist but complement each other, establishing a new standard of responsibility for companies that collect, store, process, or transfer personal or business data in El Salvador.
How do both laws relate to each other?
1. Dual legal protection of personal data:
- The Personal Data Law regulates the principles, rights, and obligations in the processing of personal data.
- The Cybercrime Law criminalizes the improper use, illegal access, or manipulation of data.
2. New subjects defined in both regulations:
- Concepts such as custodian, controller, and data processor appear in both regulations.
3. Escalation of regulatory risk:
- Possibility of incurring criminal liability for improper use, in addition to administrative fines.
4. Focus on malicious legitimate access:
- The unauthorized use of information by individuals with legitimate access is penalized.
What risks do companies face?
- Criminal proceedings against individuals with legitimate access to databases.
- Fines or closure of operations for non-compliance.
- Reputational damage from breaches or improper use.
- Investigations by the Personal Data Protection Authority or the Prosecutor's Office.
What should companies do to comply proactively?
1. Legal and technical diagnosis of data flows.
2. Update contracts with employees and suppliers.
3. Appointment of a Data Protection Officer (DPO).
4. Implementation of internal policies and procedures.
5. Mandatory training for staff.
6. Periodic risk assessment and security measures.
Salvadoran companies must establish an organizational culture of compliance and prevention. With a robust personal data regulation and the broadening of the criminal scope, it is essential to act diligently. Compliance is no longer just a matter of image: it is a legal obligation with significant consequences.
Do you want a specific assessment for your company or a compliance plan tailored to your industry? Contact us to coordinate a specialized legal audit.
