The reform eliminates the requirement to appoint this position, but maintains companies' responsibilities regarding the protection of personal data.
El Salvador's Legislative Assembly approved an amendment to the Personal Data Protection Act that eliminates the requirement for private companies to appoint a personal data protection officer.
The amendment was approved on September 17, 2026, with 57 votes and aims to give private companies and organizations greater flexibility to determine internally how they will fulfill their responsibilities regarding the processing of personal information.
However, the elimination of the mandatory data protection officer does not mean that companies are exempt from complying with the law. Individuals and private legal entities that collect, store, use, share, or process personal data will continue to be subject to the law.
What will change for private companies?
Prior to the reform, the law required regulated entities to appoint a data protection officer, who was responsible for overseeing compliance with the regulations and handling requests submitted by data subjects.
With the approved amendments, private companies will no longer be required to formally incorporate this position into their organizational structure or to report the appointment to the State Cybersecurity Agency.
Functions related to serving data subjects will be handled directly by each company or organization, which will be free to designate the department, procedure, or individual responsible for managing them
Therefore, the reform eliminates a specific organizational obligation, but it does not eliminate corporate liability for the processing of personal data.
Data protection obligations remain in effect
Companies must continue to respond to requests related to ARCO-POL rights:
- Access.
- Correction.
- Cancellation.
- Opposition.
- Portability.
- I forgot.
- Limitations on processing.
These requests must be submitted directly to the company, institution, or organization that holds or uses the personal data.
The obligated party will have 20 business days to issue a response. This period may be extended by an additional 20 business days if there are justified reasons and a reasoned decision is issued.
If a request is incomplete or requires additional information, the company may issue a one-time notice, and the data subject will have 10 business days to correct the omission.
The reform also stipulates that, when a person requests the correction of their data, a record must be made stating that the information is in the process of being corrected. If the data has already been shared with third parties, those parties must be notified of its correction, update, or deletion within five business days after the request is deemed valid.
Likewise, requests in which an individual withdraws their consent to the processing of their data must be addressed within five business days.
Compliance is now the direct responsibility of each company
Although it will no longer be mandatory to appoint a data protection officer, companies will continue to be subject to the provisions, controls, and potential penalties set forth in the Personal Data Protection Act.
This means that they must have internal mechanisms in place that allow them to:
- Receive and record requests from account holders.
- Respond within the statutory time limits.
- Identify what personal data they collect and for what purpose.
- Maintain security measures to protect information.
- Control access to, use of, and transfer of data.
- Document the actions taken to demonstrate compliance with regulations.
In practical terms, each company must determine who will assume these responsibilities and what channel will be established to allow customers, employees, suppliers, and other data subjects to exercise their rights.
Although the formal appointment of a data protection officer will no longer be mandatory, it may still be advisable for companies that handle large volumes of information, sensitive data, or activities involving higher risks.
The public sector must retain the delegate
The reform expressly maintains the obligation of public institutions to appoint a data protection officer.
This function may be carried out by the institution's own information officer, with the aim of making use of existing administrative structures.
It also provides that the President of the Republic shall appoint the Director of Personal Data Protection at the State Cybersecurity Agency for a three-year term.
This official will be familiar with the administrative penalty procedures and will retain the authority to impose the penalties established by law.
Is the reform already in effect?
The reform was approved by the Legislative Assembly, but its approval does not mean that it took effect immediately.
The decree must be published in the Official Gazette and will take effect eight days after that publication. Therefore, companies should monitor the official publication to determine the exact date on which the amendments will take effect.
What should companies do now?
The reform represents a reduction in administrative burdens, especially for micro, small, and medium-sized enterprises. However, it also means that the responsibility for ensuring compliance will fall directly on each entity.
Companies should take advantage of this change to review their internal processes, privacy policies, consent mechanisms, contracts, security measures, and procedures for handling requests related to personal data.
At Legal Spot, we assist companies and organizations in implementing the Personal Data Protection Act, including reviewing processes, drafting policies and documents, providing training, and designing internal compliance mechanisms.
Data protection remains a legal responsibility for companies. What is changing is the way they can organize themselves to comply with it.
