{"id":46306,"date":"2026-09-18T09:11:07","date_gmt":"2026-09-18T15:11:07","guid":{"rendered":"https:\/\/garciabodan.com\/?p=46306"},"modified":"2026-09-18T09:58:09","modified_gmt":"2026-09-18T15:58:09","slug":"amendments-to-el-salvadors-personal-data-protection-law-modify-companies-obligations","status":"publish","type":"post","link":"https:\/\/garciabodan.com\/en\/amendments-to-el-salvadors-personal-data-protection-law-modify-companies-obligations\/","title":{"rendered":"Amendments to El Salvador\u2019s personal data protection law modify companies\u2019 obligations"},"content":{"rendered":"<p>The Legislative Assembly of El Salvador approved a series of amendments to the <strong>Personal Data Protection Law,<\/strong> focused on how organizations must manage compliance with their obligations in this area, particularly regarding the role of the <strong>Data Protection Officer (DPO)<\/strong> and the handling of requests to exercise ARCO-POL rights.<\/p>\r\n<p>The main change for the private sector is the elimination of the general obligation to appoint a DPO. However, this does not eliminate companies\u2019 obligations toward data subjects or their responsibility to establish internal mechanisms to address their rights.<\/p>\r\n<p>&nbsp;<\/p>\r\n<h2><span style=\"color: #2263aa;\">General obligation for companies to appoint data protection officers is repealed<\/span><\/h2>\r\n<p>The reform repeals Article 15 of the Law, which provided that all obligated entities were required to appoint a DPO to manage and process requests related to ARCO-POL rights. Article 17, concerning the duty to assist the DPO, is also repealed.<\/p>\r\n<p>This means that private companies will no longer be subject, under this provision, to a general obligation to formally maintain this role. <strong>The elimination of the DPO does not mean that compliance obligations are eliminated.<\/strong><\/p>\r\n<p>The reform expressly transfers to the <strong>obligated entity<\/strong> several responsibilities that were previously assigned to the DPO, including providing assistance and guidance to its departments or service providers and establishing internal mechanisms to manage requests to exercise ARCO-POL rights.<\/p>\r\n<p>Therefore, companies must have clear processes in place to receive, assess, and respond to requests from data subjects, even if they decide not to maintain a formal DPO.<\/p>\r\n<p>&nbsp;<\/p>\r\n<h2><span style=\"color: #2263aa;\">ARCO-POL rights and applicable deadlines remain in effect<\/span><\/h2>\r\n<p>The amendments maintain the obligations related to the exercise of data subjects\u2019 rights. Among other aspects:<\/p>\r\n<ul>\r\n\t<li>Requests must be submitted to the corresponding obligated entity.<\/li>\r\n\t<li>The deadline to respond to ARCO-POL requests is <strong>20 business days,<\/strong> extendable for an additional 20 business days when justified reasons exist.<\/li>\r\n\t<li>Incomplete requests may be subject to a single notice to cure, and the data subject has<strong> 10 business days<\/strong> to remedy the deficiencies.<\/li>\r\n\t<li>Decisions denying a request must be duly reasoned and communicated to the data subject within the deadlines established by the Law.<\/li>\r\n\t<li>Regarding withdrawal of consent, the obligated entity continues to have <strong>5 business days<\/strong> to take action.<\/li>\r\n<\/ul>\r\n<p>&nbsp;<\/p>\r\n<h2><span style=\"color: #2263aa;\">Privacy notice requirements are also modified<\/span><\/h2>\r\n<p>The amendment also modifies the requirements applicable to privacy notices. In particular, it no longer requires the name or contact information of the DPO to be included among the information specified for such notices.<\/p>\r\n<p>The relevant provision now requires an indication of the <strong>means or mechanisms available for submitting requests to exercise ARCO-POL rights.<\/strong><\/p>\r\n<p>Companies that currently identify a DPO in their privacy notices, forms, websites, or other documents should review these materials to determine whether updates are required.<\/p>\r\n<p>&nbsp;<\/p>\r\n<h2><span style=\"color: #2263aa;\">What about public institutions?<\/span><\/h2>\r\n<p>The reform establishes an important distinction for the public sector.<\/p>\r\n<p>Although the general obligation previously established is eliminated, public institutions <strong>must appoint<\/strong> a DPO, who may also serve as the institution\u2019s Information Officer. Likewise, the obligation to include the DPO\u2019s contact information in notices provided to users is eliminated.<\/p>\r\n<p>&nbsp;<\/p>\r\n<h2><span style=\"color: #2263aa;\">What comes next?<\/span><\/h2>\r\n<p>The amendments reduces a formal requirement for the private sector, but <strong>does not reduce the need for an effective compliance framework.<\/strong><\/p>\r\n<p>Companies that already have a DPO may use this change as an opportunity to review whether to maintain this structure, modify it, or assign data protection functions internally to another department or responsible individual. The key will be ensuring that the organization can comply with its obligations under the Law.<\/p>\r\n<p>Organizations that are still implementing their data protection programs should consider these changes when defining their compliance structure, internal policies, and channels for handling data subjects\u2019 requests.<\/p>","protected":false},"excerpt":{"rendered":"<p>The Legislative Assembly of El Salvador approved a series of&#8230;<\/p>\n","protected":false},"author":3,"featured_media":46311,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[229],"tags":[190,400],"class_list":["post-46306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-el-salvador-en","tag-personal-data-protection-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/posts\/46306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/comments?post=46306"}],"version-history":[{"count":3,"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/posts\/46306\/revisions"}],"predecessor-version":[{"id":46317,"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/posts\/46306\/revisions\/46317"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/media\/46311"}],"wp:attachment":[{"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/media?parent=46306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/categories?post=46306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/garciabodan.com\/en\/wp-json\/wp\/v2\/tags?post=46306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}