Regulations › Rest of world › Ecuador
LOPDP
Organic Law on Personal Data Protection
WhenIn effect since 26 May 2021
Who enforces itSuperintendencia de Protección de Datos Personales (SPDP)
Who it applies toPublic and private processing of personal data in Ecuador, and foreign controllers offering goods or services to, or monitoring, its residents.
Tell the regulatorNotify the Superintendency within 5 days of becoming aware, unless the breach is unlikely to c…
DPO requiredDPO required for public-sector processing, large-scale systematic monitoring and large-scale p…
RegistrationControllers must register with and keep updated the National Personal Data Protection Registry
Transfers abroadTransfers allowed to countries declared adequate by the regulator, or with binding guarantees…
Request deadlineAccess, rectification, deletion and objection requests answered within 15 days
Maximum fineSerious infringements: 0.7% to 1% of prior-year business volume
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to foreign controllers offering goods or services to, or monitoring behavior of, residents of Ecuador; non-residents must appoint an agent in Ecuador.Art. 3 · secondary source · source ↗
Agent requirement from the 2023 Regulation (EY summary).
Lawful basis
1
Eight bases including consent, legal obligation, contract, vital interests, public interest and legitimate interest.Arts. 7, 9 · secondary source · source ↗
Consent
2
Consent must be free, specific, informed and unequivocal; revocable at any time.Art. 8 · secondary source · source ↗
Sensitive data
2
Processing sensitive data is prohibited unless a listed exception applies, such as explicit consent.Arts. 25, 26 · secondary source · source ↗
Children
2
Adolescents 15 and over may consent; younger children need a legal representative; ages 12-15 exercise rights through a representative.Arts. 21, 24 · source ↗
People's rights
Rights
3
Information, access, rectification, deletion, objection, portability, suspension of processing, and not to be subject to solely automated decisions.Arts. 12-20 · secondary source · source ↗
Request deadline
3
Access, rectification, deletion and objection requests answered within 15 days.Arts. 13-16 · secondary source · source ↗
Marketing
1
Data subjects may object at any time to direct marketing, including related profiling.Art. 16(2) · secondary source · source ↗
Governance
DPO required
1
DPO required for public-sector processing, large-scale systematic monitoring and large-scale processing of special categories.Arts. 48-49 · source ↗
DPO qualifications
2
Regulation requires a relevant university degree (law, information systems, communication or technology) and at least five years' experience; public bodies register DPOs with the regulator.Art. 49; Regulation (Decree 904) · secondary source · source ↗
Regulation article number not confirmed.
Registration
2
Controllers must register with and keep updated the National Personal Data Protection Registry.Art. 47(12) · secondary source · source ↗
Registry operation and scope for private controllers not confirmed.
DPIA
2
DPIA required before high-risk processing, including profiling with legal effects, large-scale special categories, and systematic public monitoring.Art. 42 · secondary source · source ↗
Records
2
Records of processing required; controllers with fewer than 100 workers exempt if processing is occasional, low risk and excludes special categories.Regulation (Decree 904), article not confirmed · secondary source · source ↗
Retention
1
Data kept no longer than necessary; controllers must set deletion or periodic review deadlines; the regulator may set periods.Art. 10(i) · secondary source · source ↗
Breaches
Tell the regulator
2
Notify the Superintendency within 5 days of becoming aware, unless the breach is unlikely to create risk; processors tell controllers within 2 days.Art. 43 · secondary source · source ↗
Tell people
3
Notify affected individuals without delay and within 3 days when the breach risks their rights and freedoms.Art. 46 · source ↗
Transfers
Transfers abroad
2
Transfers allowed to countries declared adequate by the regulator, or with binding guarantees or binding corporate rules; listed exceptions include explicit consent.Arts. 55-58 · source ↗
Enforcement
Maximum fine
3
Serious infringements: 0.7% to 1% of prior-year business volume; public servants 10 to 20 basic salaries.Arts. 71-72; SPDP Res. SPDP-SPD-2025-0022-R · secondary source · source ↗
Article numbers not confirmed in text read. Business volume may be local, not global, turnover.
Criminal liability
2
Penal Code (COIP) punishes violation of privacy and unlawful disclosure of database information with 1 to 3 years' imprisonment.COIP arts. 178, 229 · secondary source · source ↗
Private action
2
Data subjects may sue for damages (Constitution art. 92 habeas data) and must be guaranteed full reparation.Art. 57(c); Constitution art. 92 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws