The framework
El Salvador regulates personal data through the Personal Data Protection Law (2024), supervised by the State Cybersecurity Agency.
For advertisers the consent posture matters most, and El Salvador sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Personal Data Protection Law (2024)
El Salvador enacted its first comprehensive law in late 2024, paired with a cybersecurity law and supervised by the new ACE; a fast-moving digital-state agenda finally acquired a privacy layer.
Marketing and advertising
Consent-first, GDPR-influenced framework. In practice that means consent before tracking or marketing outreach, documented well enough to show a regulator.
Cross-border transfers
Transfers abroad turn on adequacy or appropriate safeguards.
Enforcement and penalties
The law scales fines by severity. A ceiling means little until the authority uses it, so its docket is the better guide.