Lexincorp

Contact
17 de October de 2025
BY

Policies on the Handling and Management of Personal Data in El Salvador

Policies on the Handling and Management of Personal Data in El Salvador: A Detailed Corporate Compliance Guide El Salvador is strengthening its regulatory framework on personal data protection with the entry into force of the Policies on the Handling and Management of Personal Data, issued by the State Cybersecurity Agency (ACE). These policies develop the […]

Policies on the Handling and Management of Personal Data in El Salvador: A Detailed Corporate Compliance Guide

El Salvador is strengthening its regulatory framework on personal data protection with the entry into force of the Policies on the Handling and Management of Personal Data, issued by the State Cybersecurity Agency (ACE).

These policies develop the principles of the Personal Data Protection Law (LPDP) and set mandatory guidelines to be adopted by private companies, public institutions, NGOs, universities, technology service providers, and any entity that collects, processes, or stores personal data.

1.Scope and Mandatory Nature

The policies are of immediate and general application, covering all types of personal data processing:

  • Basic data: name, address, email, phone number.
  • Sensitive data: medical, biometric, financial, religious, and political information.
  • Data in physical and digital formats, including cloud systems, applications, and video surveillance.

ACE may audit, request information, impose sanctions, and order corrective measures in cases of non-compliance.

2. Guiding Principles

Every organization must implement its internal policies in line with LPDP principles:

  • Informed consent: no processing without the data subject’s clear authorization.
  • Specific purpose: data may only be used for the purpose for which it was collected.
  • Data minimization: do not collect more information than strictly necessary.
  • Security: obligation to apply technical, physical, and organizational safeguards.
  • Transparency: data subjects must be able to know how and why their data is used.
3. Corporate Obligations

The Policies set out specific obligations that every entity must meet:

a. Organizational Management

  • Draft internal manuals and protocols for data protection.
  • Create a record of processing activities.
  • Conduct privacy impact assessments when handling sensitive or high-risk data.
  • Appoint a Data Protection Officer (DPO) for organizations with systematic, large-scale, or sensitive-data processing.

b. Technical Measures

  • Encryption of data in transit and at rest.
  • User authentication (strong passwords, multi-factor authentication).
  • Regular backups and restore testing.
  • Penetration testing and perimeter security controls.

c.Physical Measures

  • Access control to facilities and servers.
  • Secure storage of physical documents.
  • Video surveillance compliant with regulatory standards.
  • Secure destruction of media and devices.

d. Data Transfers

  • Confidentiality agreements and specific contractual clauses with processors.
  • Encrypted transmission for any communication.
  • Notification to ACE and data subjects of incidents or security breaches within a maximum of 72 hours.
4. Oversight and Sanctions

ACE requires organizations to:

  • Perform periodic internal audits.
  • Update policies in line with regulatory changes.
  • Document evidence of compliance.

Non-compliance is classified as:

  • Minor offenses: formal breaches.
  • Serious offenses: missing protocols, failure to notify incidents.
  • Very serious offenses: processing without consent, unlawful transfers, large-scale data breaches.

Sanctions may include substantial fines, suspension of operations, or criminal liability in extreme cases.

5. Strategic Implications for Companies

Beyond legal obligation, complying with these policies means:

  • Reducing legal and financial risk.
  • Strengthening trust among clients, employees, and strategic partners.
  • Enabling international business opportunities by aligning with standards such as GDPR and ISO 27001.
6. How Lexincorp Can Support Your Organization

At Lexincorp, we support organizations across sectors in implementing these policies through:

  • Compliance assessments with the LPDP and the Policies.
  • Drafting and adapting manuals, internal protocols, and third-party contracts.
  • Training teams in data protection and cybersecurity.
  • Advisory on the appointment and responsibilities of the DPO.
  • Representation in audits, inspections, or sanction proceedings.

Compliance is no longer optional. Compliance is strategic.

Contact us at info@lexincorp.com