New Law for the Protection of Personal Data
Published in Official Gazette No. 219, Volume 445, on November 15, 2024, the new law for the protection of personal data in El Salvador aims to establish the basic guidelines for the protection of personal data, including but not limited to the essential requirements for data processing, collection, use, processing, and storage.
The main aspects to consider from this law are as follows:
a) Subjects of Application: Any natural or legal person, whether public or private, engaged in activities related to or connected with the processing of data, either partially or fully. The law expressly excludes data that has special regulation, such as those related to credit history, civil status records, and generally those that do not have commercial use.
b) Personal Data: For the purposes of this law, personal data is defined as any information in text, image, or audio format that allows the identification of a person, including their address, nationality, family status, and contact channels. These contact channels include their phone number, email address, or any data that provides numerical, alphabetical, graphical, photographic, acoustic, or other types of information. The law also includes sensitive personal data, which refers to information that affects the most intimate sphere of the data subject.
c) ARCO-POL Rights: These are personal and independent rights of Access, Rectification, Cancellation, Opposition, Portability, Forgetfulness, and Limitation, through which the data subject can exercise control over the processing of their personal data. These rights can be summarized as follows:
i) Right to Data Protection: The right to know if your personal data is being processed and to ensure its protection, rectification, cancellation, or blocking. This right allows obtaining an intelligible reproduction of the data and transferring it when deemed appropriate.
ii) Right to Information Regarding Data Collection: This right allows individuals to know who will safeguard their data, including third-party providers.
iii) Right of Access to Personal Data: The right to obtain all information held about oneself in databases or physical records.
iv) Right to Rectification: The right to request the correction or rectification of inaccurate, incomplete, or outdated personal data.
v) Right to Cancellation or Deletion: The right to request the deletion of personal data without undue delay, provided the conditions established by law are met. This right also includes the right to be forgotten when personal data has been published in the electronic environment. This may also lead to the blocking of personal data, which will only be kept for public administration, judges, and courts strictly in the exercise of their functions.
vi) Right of Opposition: The right to request the cessation of data processing for commercial purposes or direct marketing.
vii) Right to Limitation: The right to limit the processing of personal data when certain conditions established by law are met.
viii) Right to Portability: The right to receive personal data provided by the data subject in a commonly used, machine-readable, and interoperable format.
d) Data Protection Officer: The subjects must appoint a data protection officer to manage and process requests for the exercise of ARCO-POL rights.
For additional inquiries, feel free to contact us at aportillo@lexincorp.com.
Written by: Adriana Portillo
