El Salvador ICT Cybersecurity and Information Security Law

El Salvador has recently enacted cybersecurity and data protection legislation that establishes a framework for national cybersecurity, as well as for the collection, processing, and storage of data.  The laws create opportunities for U.S. companies specializing in IT infrastructure and digital data processing and protection solutions.

In November 2024, the Salvadoran Legislative Assembly passed the Cybersecurity and Information Security Law, which created the State Cybersecurity Agency (ACE) as the national body responsible for overseeing and coordinating cybersecurity efforts.  The ACE is tasked with developing and implementing the National Cybersecurity and Information Security Policy (NCISP), issuing regulations and standards to secure IT systems and infrastructure, and managing cyber threats.  The law requires all public entities operating critical infrastructure to implement cybersecurity management systems and develop IT strategies aligned with the NCISP and international best practices.

Additionally, the Legislature approved the Personal Data Protection Law, which aims to protect individual privacy and ensure citizens have control over their personal information. This law regulates the treatment of data, including cross-border flows. Private corporations and public institutions that handle personal information are required to implement robust security measures to protect data from cyber-attacks, unauthorized access, and breaches.  The ACE is responsible for enforcing data protection regulations and drafting policies and guidelines for data management.

The passage of these landmark laws demonstrates El Salvador’s commitment to becoming a technology hub in Central America. They strengthen the digital ecosystem by enabling companies to operate securely, enhancing consumer trust, and promoting innovation.

Further details on the implementation will be included in the regulations of the laws which are currently under development.  The Cybersecurity and Information Security Law and Personal Data Protection entered into force eight days after publication in the Official Gazette. A copy of the laws is available in El Salvador’s Official Gazette.  Date of Publication : November 15, 2024. 

For more information, contact the U.S. Commercial Service Office in San Salvador at office.sansalvador@trade.gov