Data protection in El Salvador: which companies must comply?

The Law for the Protection of Personal Data covers individuals and legal entities engaged in processing activities. Its scope and exclusions must be assessed under Articles 2 and 3; small company size does not, by itself, create a general exemption.Personal Data Protection Law, Articles 2–3.

A useful review identifies information about employees, customers, suppliers and visitors. It separates processing covered by the general framework from activities requiring a specific assessment and identifies the entity deciding why and how information is used.

The Legislative Assembly approved Decree 659 on September 17, 2026. When checked on September 23, its official record still described it as awaiting physical publication in the Official Gazette and entry into force.Decree 659 — official status.

Legislative approval, publication and commencement are separate stages. Before applying a change to a specific matter, review the published decree, its commencement provision and any rules relevant to the transition.

An edition missing from the digital archive does not establish that no paper publication exists. The National Printing Office states that dates unavailable online can be checked in its physical editions.Official Gazette archive, Consulting physical editions.

According to the Assembly’s official explanation, the approved reform would allow requests to be addressed directly to the entity holding or using the data. It would expressly retain the officer requirement for public institutions and ACE’s supervisory, control and inspection powers.Assembly announcement, September 17.

For a private business, this calls for a review of procedures and responsibilities. A possible change to the officer requirement does not remove duties relating to data processing or justify leaving requests unanswered.

The legislative announcement explains the approved change but does not replace the published text. Before changing an existing appointment or contract, confirm the reform’s precise scope, commencement and applicable guidance from the authority.

The Assembly reported specific five-business-day periods for handling consent withdrawals and notifying third parties of corrections, updates or deletions. For third-party notification, the period is linked to determining that the request is justified; it does not automatically start with every request. These are announced changes in the approved reform, whose application must be checked against the published decree.Assembly explanation of the approved procedure.

Prepare a procedure that can be aligned with the published text. Reception, identity checks, information searches, decisions and responses should have assigned owners and an evidence trail.

The review should cover the basis for using data, the information given to individuals, and organizational and security measures. ACE’s policies address matters including processing records, access controls, training and third-party management.Personal Data Protection Law, ACE personal data handling policies.

As a management measure, we recommend assigning tasks by risk and owner. A generic document that does not match the company’s systems, contracts or actual practices is unlikely to help when responding to a request or incident.

The earlier version discussed the September 16 notice and officer appointments. This update replaces that guidance with an assessment of the approved reform and the checks needed to establish its application. It does not present the earlier deadline as an active call to action or announce a new date without an official basis.

A business can begin with a focused review of the applicable framework, reform status, internal responsibilities, request channel and outstanding measures. That provides a basis for deciding what to retain, adapt or confirm before acting.