TL Insights
Back to TL Insights
CNAD Circular No. 008-2026: New Data Protection Compliance Requirements
The National Commission of Digital Assets (CNAD) issued Circular No. 008-2026, addressed to Digital Asset Service Providers and Certifiers, through which it communicates the Guidelines for Personal Data Protection Delegates issued by the State Cybersecurity Agency (ACE).
The Guidelines entered into force on August 19, 2026, and, pursuant to the Circular, the entities subject to these requirements have 20 business days to adapt their organizational and operational structures to the applicable requirements.
Among the key aspects highlighted by the CNAD is the obligation to appoint a Personal Data Protection Delegate, verify that the appointed individual meets the required profile and suitability criteria, and complete their formal registration with the ACE’s Personal Data Protection Directorate.
In addition, each entity must establish an institutional email address to serve as an official communication channel with the ACE and notify the relevant authority of such address.
From a compliance perspective, the Circular reinforces the need to integrate personal data protection into the governance structure of entities operating in the digital asset sector. The appointment of a Delegate should not be viewed merely as a formal requirement, but rather as part of a broader review of internal processes related to the processing, safeguarding, and management of personal information.
For entities supervised by the CNAD, it is advisable to promptly review their current structure, identify the professional who will assume this role, and complete the required actions within the established timeframe.
Torres Legal supports technology and digital asset companies in their regulatory compliance and adaptation processes related to personal data protection.
Next articles in this category
October 2026
From the Trading Floor to Blockchain: The New Paths of Money in El Salvador
For years, investing in El Salvador meant one thing: buying stocks or bonds through a brokerage firm and waiting. But El Salvador's securities market is no longer the small and predictable market it once was. Today, two paths are reshaping how companies raise capital and how individuals can grow their money: securitization and digital assets. Neither is exactly "new," but together they are creating an alternative market alongside the traditional securities market, one that is more flexible, more digital, and, in theory, more accessible.
September 2026
Reforms to the Law for the Promotion of Investment Expansion
The Legislative Assembly approved the reform to the Law for the Promotion of Investment Expansion on September 9, 2026. The reforms will enter into force eight days after their publication in the Official Gazette. The amendments broaden access to the regime by reducing the minimum operating history requirement, allowing participation by corporate groups, easing exclusion rules, and introducing a new methodology for calculating the tax credit.
September 2026
New Professional Liability Rules For Urban Development And Construction
El Salvador has enacted a new Special Law on Professional Liability regulating the planning, design, execution, supervision, control, and maintenance of urban development and construction projects. The law applies to natural and legal persons subject to registration in the Registry of Professionals and Service Providers for Urban Development and Construction. It entered into force on September 19, 2026, as communicated by the Directorate of Territorial Planning and Construction (DOT) on September 21, 2026. As of the date of this publication, the law is not yet available for consultation on the Official Gazette’s website.
August 2026
Personal Data Protection Law in El Salvador: Everything You Need to Know About the CNAD’s New Provisions
Digital Asset Service Providers and Certifiers overseen by the National Digital Assets Commission (CNAD) must review the designation, profile, and registration of their Personal Data Protection Delegate, as well as establish an institutional communication channel with the State Cybersecurity Agency (ACE), in accordance with the new personal data protection provisions in El Salvador.
