What Is LPDP? Ley para la Protección de Datos Personales
El Salvador has an enacted comprehensive personal-data statute: the Ley para la Protección de Datos Personales, Legislative Decree 144. The official ACE text records publication in the Diario Oficial on 15 November 2024 and provides that the decree enters into force eight days after publication, making the effective date 23 November 2024. This corrects the possibility that only a bill or sectoral protection exists: the reviewed official sources show an operative comprehensive law. The law applies to public and private subjects and defines ARCO-POL rights: access, rectification, cancellation, opposition, portability, olvido, and limitation. It also contains important exclusions, including credit-history processing governed by the separate credit-history regime and specified public records. ACE is the governing agency for the law’s data-protection functions, and its official materials show implementation policies and a sanctioning procedure. For broker analysis, the statute expressly classifies commercializing personal data without the holder’s consent as a very serious infraction and regulates international transfers. No official people-search-specific registry, broker opt-out portal, or broker-specific enforcement history was located. The statutory exclusions for credit-history processing and certain public records mean that a broker’s coverage must be analyzed by data source and activity rather than assumed from the existence of the general law.
At a glance
- Full name
- Ley para la Protección de Datos Personales
- Short code
- LPDP
- Jurisdiction
- El Salvador
- Enacted
- 2024
- Last major update
- Decree 144 was published in the Diario Oficial on 15 November 2024 and entered into force eight days later, on 23 November 2024. ACE has published implementation policies and a sanctioning-procedure document; no later amending statute was located in the reviewed official sources
- Regulator
- Agencia de Ciberseguridad del Estado (ACE), through its data-protection functions
- Private right of action
- Limited
Scope, who LPDP covers
Protected data
Data subject rights
Right to know whether personal data are being processed and to receive the information required by the law’s collection notice
Right of access to personal data and relevant processing information, without charge under the statutory conditions
Right to rectification or updating of inaccurate, incomplete, or outdated data; the statute provides a 20-business-day period for the request procedure
Right to cancellation or suppression, including a statutory right to be forgotten for qualifying electronic data and search-engine results, subject to listed exceptions
Right to oppose processing, including commercial marketing or profiling in the cases covered by the law
Right to portability and limitation as provided by the ARCO-POL framework
Right to complain to ACE and to use applicable civil or criminal remedies; the law requires the responsible party to prove consent or notice in the relevant circumstances
Notable features
The law is an enacted comprehensive regime with a named state agency, ARCO-POL rights, a collection-notice duty, security and international-transfer rules, and published sanction ranges. Its exclusions for credit-history processing and specified public or civil-status records are central to assessing data-broker coverage. ACE’s official current materials show that implementation work continues through policies and sanctioning procedures.
Enforcement & penalties
Regulator: Agencia de Ciberseguridad del Estado (ACE), through its data-protection functions
Penalties: Article 57 sets fines in current monthly minimum wages for the commerce sector: 1–10 for light infractions, 11–25 for serious infractions, and 26–40 for very serious infractions. The official text lists failure to handle ARCO-POL requests, unlawful purpose changes, unauthorized transfers, and commercializing personal data without consent among the classified infractions. ACE may also order measures to restore legality or correct the affected rights, and Article 58 preserves civil and criminal responsibility.
Private right of action: The law provides an administrative route before ACE and expressly says its sanctions do not exempt an infringer from civil or criminal responsibilities. No general standalone private data-protection damages procedure was identified in the reviewed official materials, so any civil or criminal claim remains dependent on the applicable law and facts.
Relevance to data brokers
The statute directly addresses commercialization: commercializing personal data without the holder’s consent is listed as a very serious infraction, with unauthorized transfers also addressed. No dedicated people-search or data-broker registration, suppression portal, or enforcement history was located in the reviewed ACE materials, and public-record or credit-history exclusions may change the analysis for particular datasets.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does El Salvador have a comprehensive personal-data law?+
Yes. Legislative Decree 144 enacted the Ley para la Protección de Datos Personales. It was published on 15 November 2024 and took effect eight days later, on 23 November 2024.
What are ARCO-POL rights?+
The law names access, rectification, cancellation, opposition, portability, olvido, and limitation. The precise scope and exceptions depend on the request and on exclusions such as specified public records and credit-history processing.
Can an El Salvador data broker commercialize personal data without consent?+
The law lists commercializing personal data without the holder’s consent as a very serious infraction. No dedicated people-search opt-out portal was located, and the law’s public-record and credit-history exclusions require source-specific analysis.
Official sources & citations
- ACE: official text of Legislative Decree No. 144
- Diario Oficial: Decree 144 publication issue
- ACE: current data-protection policies and procedures
- ACE: official access-right request form
- ACE: official right-to-be-forgotten request form
- Ministry of Finance: official ARCO-POL access service
- Migration Directorate: official data-protection request forms
Other international privacy regimes
LPDP sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: