Are personal phone numbers protected in El Salvador?

[rabiakhatun785]

Yes, personal phone numbers in El Salvador are now protected by law, particularly with the recent enactment of the Personal Data Protection Law (Decree 144), which came into effect on November 23, 2024. This marks a significant shift in data privacy and gives individuals greater control over their personal information, including their phone numbers.

Firstly, the new Personal Data Protection Law establishes a comprehensive legal framework for the processing of personal data in El Salvador, applicable to both public and private entities. This law is grounded in principles such as informed consent, transparency, data el-salvador phone number list minimization, and data security. For personal phone numbers, this means that companies and organizations are now explicitly required to obtain explicit, free, and specific consent from individuals before collecting, storing, or processing their phone numbers for any purpose, especially for marketing. This is a crucial safeguard, as it prevents companies from indiscriminately using phone numbers without the owner's knowledge or approval.


Secondly, the law grants individuals several fundamental rights, often referred to as ARCO-POL rights (Access, Rectification, Cancellation, Opposition, Portability, Oblivion, and Limitation). These rights empower data subjects to manage their personal information effectively. Specifically for phone numbers, the "Opposition" right allows individuals to object to the processing of their data in certain circumstances, which includes telemarketing calls. This means that if someone receives unwanted calls, they have a legal basis to request that their number be removed from marketing lists. The "Cancellation" and "Right to Be Forgotten" also allow individuals to request the deletion of their phone numbers if they are no longer necessary for the purpose for which they were collected.


Thirdly, the law introduces strict obligations for data controllers and processors, emphasizing "Proven Responsibility." This means that organizations handling personal data must not only comply with the law but also be able to demonstrate their compliance through robust technical and organizational measures. This includes implementing strong security protocols to protect phone numbers from unauthorized access, loss, or alteration. Furthermore, the law mandates the notification of any security breaches involving personal data within a maximum of 72 hours, which provides an additional layer of protection for phone numbers and other sensitive information. Penalties for non-compliance can be significant, ranging from fines to other administrative sanctions.