76%
of Ecuador's 21 requirements are already met by European Union (GDPR). Here is what LOPDP adds, biggest gaps first.
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
LOPDP adds2 Controllers must register with and keep updated the National Personal Data Protection Registry.
Art. 47(12) · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
LOPDP adds3 Access, rectification, deletion and objection requests answered within 15 days.
Arts. 13-16 · source ↗
DPO qualificationsGovernanceGap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
LOPDP adds2 Regulation requires a relevant university degree (law, information systems, communication or technology) and at least five years' experience; public bodies register DPOs with the regulator.
Art. 49; Regulation (Decree 904) · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
LOPDP adds3 Notify affected individuals without delay and within 3 days when the breach risks their rights and freedoms.
Art. 46 · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
LOPDP adds2 Penal Code (COIP) punishes violation of privacy and unlawful disclosure of database information with 1 to 3 years' imprisonment.
COIP arts. 178, 229 · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Children, Rights, Marketing, DPO required, DPIA, Records, Retention, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.
A gap means LOPDP is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
