Ley para la Protección de Datos Personales, cross border transfer of personal data

Decreto Legislativo No. 144, arts. 41, 44 and 45 (international transfer of personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 23 November 2024.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal data internationally, sign a contract with the receiving party that holds it to at least the same personal data protection obligations you carry.
Before transferring personal data to another country or international organization, confirm the receiving country meets at minimum this Law's data protection principles or applicable international standards, and take appropriate measures to secure the data at the point of transfer if the receiving country's protection is not adequate.
Obtain the data subject's prior consent before an international transfer of their personal data, unless a reciprocal treaty exception applies or the transfer falls under a Central American Economic Integration treaty.
Report your cross border personal data flows to the Entidad Rectora together with the transfer information and your database's registration.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 41 requires the party transferring personal data to sign a contract with the receiving responsible party that binds the recipient to at least the same obligations the transferring party carries.

Article 44 permits any transfer of personal data to another country or international organization only where the receiving or importing country meets at minimum this Law's data protection principles or applicable international standards, never lower than El Salvador's own legal requirements, and requires the transferring party to guarantee this Law's standard is met where the receiving country's protection is not adequate, while exempting transfers made under Central American Economic Integration treaties and always requiring the data subject's prior consent absent a reciprocal treaty exception.

Article 45 lets a responsible party ask the Entidad Rectora for an opinion on whether its cross border data flow complies with this Law, and requires every cross border data flow to be reported to the Entidad Rectora together with the information needed for the transfer and the database's registration.

When LexLint raises it

crawls_web
trains_models
ships_mobile_app
distributes_software_product

Read the law

Official decree text, Asamblea Legislativa de El Salvador, published Diario Oficial No. 219, Tomo 445, 15 de noviembre de 2024

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app