The recent issuance of the Personal Data Management and Handling Policies by the State Cybersecurity Agency represents a decisive step in the effective implementation of the Personal Data Protection Law (LPDP) in El Salvador. Although the LPDP already covered most of the fundamental principles and obligations regarding data protection, the new Policy not only develops these issues in greater detail, but also introduces an approach aligned with international standards, with particular reference to the ISO 27001 standard: Information security, cybersecurity, and privacy protection – Information security management systems, recognized in El Salvador as the Salvadoran Technical Standard (NTS ISO/IEC 27001:2022).
With these advances, organizations face a crucial challenge: translating legal provisions into effective data management and information security practices. This international standard provides a systematic framework for designing, implementing, and continuously improving an Information Security Management System (ISMS), integrating specific controls that ensure the protection of personal data and are now directly required by Salvadoran regulations.
I- From the legal framework to the operational framework
The LPDP imposes on data controllers and processors the obligation to implement appropriate technical and organizational measures to ensure data security. However, the law does not detail how to do this. This is where ISO 27001 provides invaluable support, as it establishes concrete guidelines for transforming the legal obligation into verifiable and auditable processes.
For example, the controls in Annex A of ISO 27001 (adopted in the Salvadoran NTS) cover topics such as:
- Information classification (5.12).
- Secure data transfer (5.14).
- Secure disposal of personal data (8.10).
- Prevention of information leaks (8.12).
All of these are aligned with the LPDP’s requirements regarding confidentiality and security.
II- Governance, roles, and leadership in data protection
The ISO 27001 standard requires commitment from senior management (section 5), with the definition of a clear information security policy and the assignment of responsibilities. This is complemented by the LPDP, which requires the appointment of a Data Protection Officer within each organization.
The convergence of both frameworks means that the data protection officer must not only ensure regulatory compliance, but also integrate into the ISMS, generating periodic reports, monitoring incidents, and ensuring that the organization’s strategic decisions are aligned with data protection.
III- Risk management as a central axis
The risk-based approach of ISO 27001 (section 6) is one of its most relevant pillars for personal data protection. While the LPDP imposes general security obligations, the standard requires each organization to identify, analyze, and address specific risks that may compromise the personal information it manages.
Example: a clinic that stores medical records must assess the risk of unauthorized access and establish specific measures such as role-based access controls or multi-factor authentication. This level of practical analysis allows for demonstrating diligence to the Salvadoran authority and responding appropriately to audits or inspections.
IV- Incident preparedness and response
Both the LPDP and ISO 27001 agree on the need for documented incident management protocols. The difference is that ISO establishes the method: notification, analysis, mitigation, documentation, and continuous improvement (controls 5.24–5.27).
This ensures that, in the event of an incident such as the loss of a database or a cyberattack, the organization not only complies with the legal obligation to notify the authorities and data subjects, but also learns from each incident to prevent its recurrence.
V- Organizational culture and continuous improvement
One of the great challenges of the LPDP is to make data protection part of the corporate culture. ISO 27001 reinforces this aspect through awareness programs and continuous training (control 6.3), as well as internal audits and management reviews (sections 9.2 and 9.3).
In this way, data protection ceases to be an isolated requirement and becomes a constant cycle of improvement, with metrics, periodic reviews, and documented corrective actions.
VI- Final considerations
The adoption of ISO 27001 in El Salvador not only responds to a need for regulatory compliance, but also translates into a strategic advantage. A certified organization can demonstrate to customers, business partners, and authorities that it complies with international security standards, which increases trust and opens up business opportunities, even in international markets where certification is a requirement.
The entry into force of the LPDP marked a turning point in the management of personal data in El Salvador. However, the real challenge is to move from the letter of the law to organizational practice. In this transition, ISO/IEC 27001:2022, adopted as a Salvadoran technical standard, stands as the ideal methodological framework for effectively implementing legal requirements and demonstrating compliance to authorities and society. Its integration not only strengthens security and privacy, but also boosts the trust and competitiveness of organizations in the digital age.