Thursday, June 19, 2025 — The Legislative Assembly of El Salvador has approved reforms to the Special Law Against Cybercrime and Related Offenses, aiming to strengthen the legal framework against the growing threat of digital fraud in the country. One of the most notable changes is the increase in prison sentences for those convicted of cyber fraud, raising the penalty from the previous range of six to ten years to a new range of ten to twelve years.

With 57 votes in favor, lawmakers endorsed several amendments to the law, reaffirming their commitment to protecting the population’s digital data and imposing stricter penalties on those who engage in technological crimes.

One key update is the addition of new subparagraphs to Article 3 of the law, introducing definitions for data owner, data custodian, data controller, data processor, and metadata. These clarifications aim to define the roles of various actors involved in managing and safeguarding digital information.

Article 11, which addresses the offense of cyber fraud, was also modified to include the manipulation of system configurations and the insertion of false or fraudulent instructions as punishable actions. Additionally, a new paragraph introduces an aggravating circumstance when the offense is committed by individuals who regularly have legitimate access to data systems.

This aggravating factor applies to those who, by virtue of their duties, have access to databases, sales platforms, contact center services, blockchain-based technologies, CRM systems, or other systems where third-party information is stored, and who use this access to illegitimately consult, extract, or alter information, grant unauthorized benefits, or create false records for personal or third-party gain.

The reform not only reinforces legal protections for data but also aims to preserve digital trust, boost the country’s global competitiveness, safeguard jobs in the tech sector, and position El Salvador as a secure and modern destination for digital industry investment.

The Special Law Against Cybercrime and Related Offenses was enacted to penalize criminal acts committed through Information and Communication Technologies (ICT), with the goal of protecting identity, privacy, image, and property of both individuals and legal entities.