NEW LAWS IN EL SALVADOR IMPROVE CYBERSECURITY AND PROTECT PERSONAL DATA

El Salvador is setting an important precedent in Central America. On November 12, 2024, the Legislative Assembly of El Salvador approved the Personal Data Protection Law and the Cybersecurity Law. These regulations will complement each other and aim to ensure information security and protect the data that citizens share with both state institutions and private companies. Among the main benefits of this initiative are:

• The Prevention of Cyber Crimes: By establishing stricter cybersecurity measures, the risk of hacks, fraud, and other types of cyber attacks can be mitigated.

To ensure the effective implementation of these laws, an entity called the State Cybersecurity Agency will be created. This institution will be responsible for developing the National Cybersecurity Information Policy, which will include the guidelines, plans, and action programs necessary to ensure compliance with the regulations. The individuals in charge of this entity must have proven experience in cybersecurity and information security to guarantee reliability among the population.

· Cybersecurity Law

The Cybersecurity and Information Security Law will establish the principles, legal framework, institutional structure, guidelines, and protection policies to structure, regulate, audit, and oversee cybersecurity and information security measures within public institutions. It will regulate public and private institutions that handle data, requiring them to protect the information of Salvadorans. Additionally, it will prevent activities related to cybercrime. To ensure greater effectiveness in its implementation, a national registry of cybersecurity threats and incidents will be created, facilitating a faster and more secure response.

The law will apply to all government bodies, their dependencies, autonomous institutions, municipal authorities, and any other entity or organization, regardless of their form, nature, or legal status, that manage public resources, state assets, execute administrative acts, or have an impact on the nation's critical infrastructure. This also includes private sector entities.

· Personal Data Protection Law

This law will guarantee the right to privacy, which will facilitate the protection of other fundamental rights, such as freedom of expression and privacy in the digital age. Additionally, it will ensure that the personal data of the population remains private and is only used by those who provide it or require it for a legitimate cause. The law also aims to prevent violations and transgressions of the right to privacy by establishing clear guidelines on how information will be collected, used, processed, and stored, as well as other activities related to personal data. It will apply to both natural and legal persons, public and private, who manage the personal data of Salvadorans. Likewise, state bodies, their dependencies, autonomous institutions, and municipal authorities will be subject to it.