Art. 5 of the Law for the Regulation of Information Services on Credit History of Persons states that the Central Reserve Bank shall have unrestricted access to the databases of public law institutions or private entities containing real-time credit history data information on individuals.

The Intellectual Property Law establishes a safe harbour regime under which intermediaries that control computer systems connected to digital communication networks may be exempted from liability for copyright infringements committed through their systems. Arts. 305.n and 306 jointly provide that operators and other intermediaries are liable only when they have actual or duly substantiated notice of infringing activity, or when the infringement could not reasonably be ignored without gross negligence. Once placed on notice, intermediaries must act promptly to remove or disable access to the infringing material in order to retain the safe harbour protection. They are exempt from liability when acting in good faith and adopting appropriate technical measures to prevent or halt unauthorised uses of protected works.
In addition, Art. 24 of the Law of Electronic Commerce establishes that providers offering internet access services or data transmission via telecommunications networks shall not be held liable for electronic commercial transactions carried out by users in respect of the goods or services acquired, nor for the information transmitted or its content, unless the provider itself has initiated the transmission, altered the data, or selected the data or their intended recipients.

Art. 24 of the Law of Electronic Commerce establishes that providers offering internet access services or data transmission via telecommunications networks shall not be held liable for electronic commercial transactions carried out by users in respect of the goods or services acquired, nor for the information transmitted or its content, unless the provider itself has initiated the transmission, altered the data, or selected the data or their intended recipients.

It is reported that El Salvador imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

Foreign companies have reported that customs regulations and procedures in El Salvador are applied inconsistently and discretionarily, resulting in unpredictable delays and administrative fines. Exporting from a duty-free zone is considered unduly cumbersome, as representatives of both the receiving and shipping companies must be physically present to exchange documents and release materials, although the government has begun piloting online processing. In addition, the customs valuation process for express shipments remains unclear.

Self-certification is permitted in El Salvador for radio transmission equipment and for compliance with electromagnetic interference (EMI) and electromagnetic compatibility (EMC) requirements, allowing both domestic and foreign companies to demonstrate conformity through a Supplier Declaration of Conformity (SDoC), whereby the supplier or manufacturer attests that the equipment meets the applicable technical and administrative requirements. In practice, the conformity assessment procedures for EMC and EMI rely on such declarations, as there is no obligation to register equipment with the regulatory authority, nor a requirement to undertake testing in an accredited or recognised laboratory; where testing is conducted, the choice of laboratory remains at the discretion of the supplier or manufacturer. Compliance is primarily assessed against standards established by the International Telecommunication Union (ITU).

Art. 44 of the Law for the Protection of Personal Data stipulates that international transfers of personal data are permitted only when the recipient country adheres to the principles set out in this Law or the transfers are conducted through recognised international standards. Where the recipient country lacks an adequate level of protection, the transferring country must ensure compliance with this Law during data processing. Regardless of the recipient country’s protection level, data controllers must adopt appropriate and effective measures to ensure both the proper handling of the transferred data and the security of records at the time of transfer. An exception applies to transfers carried out under Central American Economic Integration treaties, where data transfers may proceed in accordance with the terms legally agreed by member states. In all cases, prior consent from the data subject is required, unless international instruments provide otherwise and such provisions are reciprocally applied among the signatory countries.

Arts. 31-33 of the Public Procurement Act provide special rules for micro, small and medium-sized enterprises (MSMEs). Art. 31 stipulates that priority in the evaluation of bids may be given to goods manufactured and/or produced in the country. Art. 32 establishes that public administration entities and municipalities should seek to procure or contract with national MSMEs to the extent that they represent at least 25% of their annual budget for procurement and contracting of goods and services, provided that they guarantee the quality of the goods and services in question. Procurement should be sourced from national, regional and local SMEs in the area where the respective procurement and contracting takes place. Furthermore, at least 10% of the budget for procurement and contracting of goods and services should be procured or contracted from MSMEs that are owned, majority-owned or legally represented by women. Finally, Art. 33 establishes that, in the event of two or more evaluated bids whose price and qualification are equal based on the evaluation criteria and other conditions required in the application documents, preference shall be given to the bid submitted by a micro or small enterprise.
The Law on Acquisitions and Contracting of the Public Administration repealed the Law on Acquisitions and Contracting of the Public Administration, which contained similar requirements to those mentioned above in Arts. 39-A and 39-C.

El Salvador has been operating under a state of exception since March 2022, which has been renewed on a monthly basis. As part of the implementation of this measure, the government enacted Decree No. 359, applicable for the duration of the state of exception, which permits the executive branch to negotiate and procure goods and services related to the emergency directly, without complying with the requirements of the Public Procurement Law (Arts. 1 and 2 of Decree No. 359). Reports indicate that the absence of transparency in government procurement and contracting processes under states of emergency is particularly concerning, as it has facilitated corruption and clientelism, matters that are of considerable concern to foreign investors. It is also reported that foreign companies have expressed concerns that government agencies are not always providing sufficient advance notice to foster wide participation in bidding procedures, particularly in relation to complex infrastructure works or public-private partnership projects.

El Salvador is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

According to Art. 5 of the Investment Law, foreign investors have the same rights and obligations as Salvadoran investors and shall not be subject to unfair or discriminatory measures with respect to the establishment, administration, use, usufruct, extension, sale and liquidation of their investments.

It is reported that certain restrictions apply to micro businesses, which are defined in Art. 3 of the Law on the Promotion, Protection and Development of Micro and Small Enterprises as having 10 or fewer employees and annual sales of approximately USD 175,930 or less. Investors who start operations with 10 or fewer employees must submit plans for increasing employment to the Ministry of Economy’s National Investment Office.

El Salvador is a party to the Patent Cooperation Treaty (PCT).

El Salvador maintains a copyright framework under its Intellectual Property Law. The statutory exceptions do not align with either the fair use or fair dealing models, therefore restricting the lawful use of copyrighted works by third parties. Chapter II of Book II sets out the relevant exceptions. These include, among others, that with respect to works that have been lawfully disclosed, it is permitted, without authorisation or remuneration to the author, to reproduce a single copy of a computer program exclusively for backup or security purposes, and to load the program into the internal memory of a device solely to enable its use by a user (Art. 45). In addition, the adaptation of a computer program carried out by the user for their exclusive use does not constitute a modification of the work (Art. 49).
Similarly, Chapter III of Title Two in the previous Intellectual Property Law enumerated exceptions that also did not follow the fair use or fair dealing models.

It is reported that El Salvador’s enforcement of intellectual property rights (IPR) protections falls short of the standards set out in its formal legal frameworks, and that Salvadoran authorities possess limited resources to allocate to the effective enforcement of IPR legislation. Trade in pirated software remains prevalent.