TL Insights
Back to TL Insights
CNAD Circular No. 008-2026: New Data Protection Compliance Requirements
The National Commission of Digital Assets (CNAD) issued Circular No. 008-2026, addressed to Digital Asset Service Providers and Certifiers, through which it communicates the Guidelines for Personal Data Protection Delegates issued by the State Cybersecurity Agency (ACE).
The Guidelines entered into force on August 19, 2026, and, pursuant to the Circular, the entities subject to these requirements have 20 business days to adapt their organizational and operational structures to the applicable requirements.
Among the key aspects highlighted by the CNAD is the obligation to appoint a Personal Data Protection Delegate, verify that the appointed individual meets the required profile and suitability criteria, and complete their formal registration with the ACE’s Personal Data Protection Directorate.
In addition, each entity must establish an institutional email address to serve as an official communication channel with the ACE and notify the relevant authority of such address.
From a compliance perspective, the Circular reinforces the need to integrate personal data protection into the governance structure of entities operating in the digital asset sector. The appointment of a Delegate should not be viewed merely as a formal requirement, but rather as part of a broader review of internal processes related to the processing, safeguarding, and management of personal information.
For entities supervised by the CNAD, it is advisable to promptly review their current structure, identify the professional who will assume this role, and complete the required actions within the established timeframe.
Torres Legal supports technology and digital asset companies in their regulatory compliance and adaptation processes related to personal data protection.
Next articles in this category
September 2026
Reforms to the Law for the Promotion of Investment Expansion
The Legislative Assembly approved the reform to the Law for the Promotion of Investment Expansion on September 9, 2026. The reforms will enter into force eight days after their publication in the Official Gazette. The amendments broaden access to the regime by reducing the minimum operating history requirement, allowing participation by corporate groups, easing exclusion rules, and introducing a new methodology for calculating the tax credit.
September 2026
New Professional Liability Rules For Urban Development And Construction
El Salvador has enacted a new Special Law on Professional Liability regulating the planning, design, execution, supervision, control, and maintenance of urban development and construction projects. The law applies to natural and legal persons subject to registration in the Registry of Professionals and Service Providers for Urban Development and Construction. It entered into force on September 19, 2026, as communicated by the Directorate of Territorial Planning and Construction (DOT) on September 21, 2026. As of the date of this publication, the law is not yet available for consultation on the Official Gazette’s website.
August 2026
Personal Data Protection Law in El Salvador: Everything You Need to Know About the CNAD’s New Provisions
Digital Asset Service Providers and Certifiers overseen by the National Digital Assets Commission (CNAD) must review the designation, profile, and registration of their Personal Data Protection Delegate, as well as establish an institutional communication channel with the State Cybersecurity Agency (ACE), in accordance with the new personal data protection provisions in El Salvador.
August 2026
Personal Data Protection: The State Cybersecurity Agency (ACE) Strengthens the Supervision and Compliance Framework
Personal data protection in El Salvador is entering a phase of greater operational development and oversight. The Law protects all information that allows a natural person to be identified or identifiable, including information that, by its nature, requires a higher level of protection. With the publication of the new Guidelines for the Data Protection Officer and the Regulations for the Development of Administrative Sanctioning Proceedings, the State Cybersecurity Agency (ACE) establishes key aspects regarding who may serve as a Data Protection Officer, how their appointment must be formalized and registered, and how the Agency may investigate and sanction potential non-compliance. Both provisions were published in the Official Gazette on August 11, 2026, and entered into force on August 19, 2026.
