The El Salvador Assembly announced, on 22 April 2021, that it had passed the Law on Protection of Personal Data and Habeas Data. In particular, the Assembly highlighted that the Law affords rights of access, rectification, cancellation, and opposition, as well as the imposition of obligations on the security of personal data for private and public entities that handle an individual's personal information, specifically through the issuance of a confidentiality notice to the owner of personal data by electronic or physical means. In addition, the Assembly noted that the Law provides a sanctioning procedure for infractions of its rules, defined in three categories: minor, serious, and very serious, with proportional penalties for each:

• minor infractions will be sanctioned with a fine of up to fifty minimum monthly wages in the commerce and services sector;
• serious infractions will be sanctioned with a fine of up to two hundred monthly minimum wages in the commerce and services sector; and
• very serious infractions will be sanctioned with a fine of up to five hundred monthly minimum wages in the commerce and services sector. 

Furthermore, the Assembly outlined that the Law contains a transitory provision where existing databases, at the time of entry into force of the Law, will have a period of six months to amend the processing of personal data to that required by the Law.

The Assembly noted that the Law is expected to enter into force one year after its publication in the Official Gazette.

You can read the press release, only available in Spanish, here.