Others

El Salvador Requires State Certification for Corporate Data Protection Officers

By Edy Portal, Eproint

El Salvador's State Cybersecurity Agency, known by its Spanish acronym ACE, has issued new binding guidelines requiring that data protection officers at public and private institutions be certified directly by the agency.

The rules, titled "Guidelines for the Personal Data Protection Delegate," were signed by ACE director Eduardo Rodríguez and took effect on August 19, 2026, following their publication in the Official Gazette on August 11. The measure represents one of the first detailed implementing regulations issued since El Salvador's data protection law came into force, and it places the government's cybersecurity agency in direct control of who may hold the compliance role inside regulated organizations.

Under Article 5 of the guidelines, every entity that processes personal data as part of its operations must appoint a delegate who has completed ACE's certification program and received a corresponding registration credential. Certified delegates must also undergo at least one training session per year on data protection matters and must draft an annual training plan for the rest of the institution's staff. The delegate is designated as the official liaison between the organization and ACE's Directorate of Personal Data Protection, and appointments must be reported to the agency through a dedicated online platform called the Registry of Delegates. That registry, according to the guidelines, will be publicly accessible, allowing anyone to look up which certified individual is responsible for data protection at a given company or government office.

The eligibility requirements for the role are specific. Candidates must hold a university degree, preferably in legal studies, be at least 21 years old, and have professional or work experience in personal data protection or administrative procedures. They cannot have prior convictions for intentional crimes, and legal entities seeking to serve as delegates cannot have been sanctioned under El Salvador's public procurement law. The guidelines bar anyone holding an executive or top-management position, such as a general manager, deputy manager, or department head, from simultaneously serving as the delegate, though external consultants, foreign nationals, and law firms or other legal entities are explicitly permitted to take on the role, including for multiple companies within the same corporate group. In public institutions, the position may be filled by the entity's existing information officer, while private companies must formalize the appointment through a board resolution or similar corporate act.

The delegate's core function is to manage what the guidelines describe as "ARCO-POL" rights, an acronym covering access, rectification, cancellation, opposition, portability, erasure, and limitation of processing. These are the mechanisms through which individuals in El Salvador can request to know what personal data an organization holds about them, correct inaccurate records, object to certain uses, or seek deletion of their information. The certification requirement effectively means that the practical exercise of these rights, at any regulated institution, now runs through a person vetted and credentialed by a state agency rather than one chosen solely by the company or public body itself.

ACE was created in November 2024 through the Law on Cybersecurity and Information Security, passed by the Legislative Assembly alongside a companion Law on Personal Data Protection. The legislation established ACE as an autonomous, decentralized state entity led by a director general appointed by the president for a three-year term, with the power to set national cybersecurity policy, investigate incidents, and issue sanctions. Under the law, violations tied to personal data, including processing data without consent, granting unauthorized access to a database, or commercializing personal data without the holder's authorization, can trigger fines ranging from one to one hundred minimum monthly salaries, as well as removal from office and disqualification from public functions for up to ten years.

The scope of the personal data law extends to any natural or legal person, public or private, that processes personal data in El Salvador, and it explicitly includes institutions supervised by the country's Superintendency of the Financial System, meaning banks and other financial entities fall under the certification requirement. Credit bureaus and companies that manage credit history records are excluded from the law's scope, as is data processing carried out in a purely domestic or family context, in public security or criminal investigations conducted with due process, and in civil registries of family and identity status.