El SalvadorLey para la Protección de Datos Personales, sensitive personal data and children
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 23 November 2024.
A sensitive categories rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Do not compel a person to provide sensitive personal data (data touching physical or moral characteristics, or facts of private life whose misuse could cause discrimination or gravely harm honor or privacy, including religious belief, ethnic origin, political or union affiliation, sexual preference, health, or biometric or genetic information); take it only with the data subject's express and unequivocal consent after telling them of their right to withhold it.
- Obtain a sensitive data subject's consent in writing, by an autograph signature or its equivalent, and apply the Progressive Exercise of Faculties principle to a child's consent to provide their personal data.
- Process health data, as a health establishment or professional, only for a patient under your care and only for prevention, diagnosis, treatment or health service management, under professional secrecy.
- Collect or process sensitive personal data only where this Law authorizes it, another statute authorizes it for a general interest, you have a legal mandate, or the purpose is statistical or scientific and the data have been dissociated from the data subject.
- Do not create a database of sensitive personal data in violation of this Law.
- Guarantee the best interests of a child or adolescent in any processing of their data, and inform both the child and their parent or guardian, in clear and age appropriate language, before exercising the child's rights.
What it reaches
Obligation class
Prohibition, Consent, Biometric
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 4(g) defines sensitive personal data as data touching a person's physical or moral characteristics or facts of their private life whose misuse could cause discrimination or gravely harm their honor, personal or family privacy, or image, naming religious belief, ethnic origin, political affiliation, union affiliation, sexual preference, physical and mental health, and biometric or genetic information among the enumerated examples.
Article 26's last paragraph requires a responsible party to obtain a sensitive data subject's written consent, by an autograph signature or its equivalent, a heightened standard above the ordinary consent article 26's first paragraph sets, and its second paragraph applies the Progressive Exercise of Faculties principle to a child's consent to provide personal data.
Article 37 bars compelling anyone to provide sensitive personal data, conditions its processing on the data subject's express and unequivocal consent after being told of the right to withhold it, and excuses that consent only to safeguard the life of an incapacitated data subject or another person, or where a health professional or an equivalently bound person processes health data for prevention, diagnosis, treatment, or health service management under professional secrecy.
Article 38 limits collecting and processing sensitive personal data to cases this Law authorizes, cases of general interest another statute authorizes, a legal mandate, or statistical or scientific purposes once the data have been dissociated from the data subject. Article 39 lets a health establishment or health professional collect and treat a patient's physical or mental health data, respecting professional secrecy, patient rights legislation, and this Law.
Article 42 requires every kind of processing to guarantee the best interests of children and adolescents, to inform both the child and their parents or guardians of the processing before exercising the child's rights, and to present that information in clear, simple, age appropriate language.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometricsserves_minorshandles_health_records
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.