Legislative Assembly reforms the Personal Data Protection Law

The Official Gazette published on Friday, September 18, 2026, Legislative Decree No. 659, which reforms the Law for the Protection of Personal Data. The provision appears in Volume No. 452, Number 173, pages 6 to 10, within the Legislative Body, and was sanctioned by President Nayib Armando Bukele Ortez along with the Minister of Public Security and Justice, Héctor Gustavo Villatoro.

The reformed law was issued via Legislative Decree Number 144, published in Official Gazette Number 219, Volume Number 445, on November 15, 2024, and its purpose is to regulate the protection of personal data. Its scope extends to all obligated subjects under Article 2, namely, the controllers and processors of data, from both the public and private sectors, and its competent authority is the State Cybersecurity Agency (ACE).

The ACE exercises the powers of control, inspection, and supervision of the obligated institutions, the sanctioning power regarding personal data protection, and the faculty to issue, modify, or annul provisional measures. The law further mandates that obligated subjects appoint a Personal Data Protection Officer, pursuant to Article 15, and register them in the Public Registry maintained by the Directorate of Personal Data Protection.

A five-page decree in the Legislative Body

The bulletin summary records Decree No. 659 as “Reforms to the Law for the Protection of Personal Data” and assigns it pages 6 to 10, immediately following Decree No. 658, which grants tax exemptions to the Adventist Development and Humanitarian Aid Agency of El Salvador (pages 3 to 5). Both texts are published under the heading of the Legislative Body.

The decree was sanctioned at the Presidential House, in San Salvador, “on the eighteenth day of the month of September, two thousand twenty-six,” and countersigned by the Minister of Public Security and Justice. The full text of the reforms occupies the five pages that the bulletin allocates to this publication.

Who signs the reform

The board of directors of the Legislative Body signs the decree:

• Ernesto Alfredo Castro Aldana, president.
• Suecy Beverley Callejas Estrada, first vice president.
• Katheryn Alexia Rivas González, second vice president.
• Elisa Marcela Rosales Ramírez, first secretary.
• José Serafín Orantes Rodríguez, second secretary.
• Reinaldo Alcides Carballo Carballo, third secretary.

Background: the regulations that develop the law

On August 11, 2026, the Official Gazette Number 146, Volume 452, published the Guidelines for the Personal Data Protection Delegate and the regulations developing the administrative sanctioning procedure of article 53 of the law, issued by the director general of the State Cybersecurity Agency. Among its provisions are:

• Effectiveness eight days after its publication in the Official Gazette.
• A period of twenty business days to notify the Directorate of Personal Data Protection of the appointments and cessations of delegates.
• The obligation of the controller to guarantee annual training for the Delegate.
• The Personal Data Protection Delegate Certification Program that the ACE must implement.

The reform arrives when the country already has an operational sanctioning authority and a delegate registry in place, such that any change in the law directly impacts the obligations of companies, public entities, and organizations that process citizens’ data. Data controllers must review their compliance procedures in light of the text published in the Official Gazette Number 173.

Source: Official Gazette, Number 173, Volume No. 452, September 18, 2026, Legislative Body, pp. 6-10 (official reference: Legislative Decree No. 659).