El Salvador and Its New Data Protection Law: An Innovative Regulatory Framework

Analysis of the innovations in the Salvadoran legal framework and the mandatory requirements for the Data Protection Officer (DPO).

El Salvador's Data Protection Law introduces cutting-edge aspects compared to other personal data protection regulations currently in force in Central America—such as those of the Republics of Panama and Costa Rica—which do not have them, such as the mandatory designation of a Data Protection Officer (DPO) for certain types of organizations.

According to the guidelines published on August 11, 2026, in the Official Gazette of the Republic of El Salvador, among the most important aspects of El Salvador's Data Protection Law are:

The Data Protection Officer (DPO) under El Salvador's Law

The appointment of the Data Protection Officer is regulated by El Salvador's Data Protection Law and applies to both public and private entities. The DPO will primarily be responsible for handling all requests from natural or physical persons related to their ARCO-POL rights (access, rectification, cancellation, opposition, portability, erasure, and limitation).

Main requirements for the candidate to fill the DPO position

The DPO must meet, among others, the following requirements:

• Be of legal age, with at least 21 years of age.
• Hold a university degree, preferably in Legal Sciences or Law.
• Have experience related to data protection, regulatory compliance, risk management, information technology, information security, or cybersecurity.
• Not have been convicted of intentional crimes or sanctioned for related infractions.
• Obtain the corresponding certification issued by the Agency, when the program is in force. 

Formalization of the appointment

The appointment must be formally recorded through an agreement, resolution, or minutes issued by the highest competent authority of the institution or company. The document must include the identification of the designee, legal grounds, powers, and the start date of functions. 

Declaration of Conflict of Interest

Before accepting the position, the appointed person must submit a declaration regarding potential conflicts of interest. 

Registration with the Authority

The appointment must be notified to the State Cybersecurity Agency (ACE) for registration in the Register of Delegates within the established deadline. Upon validation, the ACE issues the official Delegate credential. 

Independence of the DPO and Modalities

The Data Protection Officer must perform their duties with autonomy and independence, reporting directly to the highest management level of the organization and acting as a liaison with the data protection authority.  

The Data Protection Officer may be an internal employee on the organization's payroll, or an external professional—such as the services we provide at LEGAL IT ABOGADOS—provided that all legal requirements are met.

Key functions

Among the main responsibilities of the Data Protection Officer are:  

• Monitor compliance with personal data protection regulations.
• Handle and manage the exercise of ARCO-POL rights by personal data subjects.
• Advise the organization on privacy and data protection matters.
• Coordinate relations with the ACE as the competent authority in this matter.

Continuous training and updates

The organization must ensure that the Data Protection Officer receives training and ongoing updates to properly perform their duties. 

Substitution

If the DPO resigns, is removed, or becomes unable to exercise the role, a substitute must be appointed within the timeframes established by personal data protection regulations.

For more information on Personal Data Protection and Privacy, you may contact our Expert in the Salvadoran Data Protection Law, attorney Julio Martínez Quintanilla, at: jmartinez@legalitabogados.com