Ecuador: AI and data protection regulation
Ecuador has no AI law, but the data protection authority already enforces specific rules for any AI that processes personal data.
GROU LLC · built on AI Business Core, by Vreinn · · How we verify sources
Summary
The binding AI rule is Resolution SPDP-SPD-2026-0009-R from the Personal Data Protection Superintendency, in force since March 2026 and amended in September 2026: it requires disclosing AI use, managing risks, assessing impact when needed, listing AI in the processing record and auditing systems. On top of it sit the Personal Data Protection Law and other Superintendency resolutions on data protection officers, legitimate interest and international transfers. Fintech firms also have algorithm governance rules. The national AI strategy published in January 2026 is guidance, and the general AI bill was archived in September 2026.
- Binding AI law today?
- Yes
- Obligations verified in the official source
- 79 %
- Information as of
Authorities
- Personal Data Protection Superintendency (SPDP)
Data protection authority; supervises and penalizes AI use involving personal data
- Superintendency of Banks
Supervises algorithms and risks of fintech and financial entities
- Ministry of Telecommunications and Information Society (MINTEL)
Lead agency for the national AI strategy
Rules covered
| Rules | Status | Obligations and dates |
|---|---|---|
| Organic Personal Data Protection Law and its regulation LOPDP | In force | 5 |
| General rule on data protection in AI systems SPDP AI rule | In force | 9 |
| Risk management and impact assessment guide SPDP Res. 2025-0003-R | In force | 1 |
| Data Protection Officer Regulation SPDP Res. 2025-0028-R | In force | 1 |
| Legitimate interest rule SPDP Res. 2025-0041-R | In force | 1 |
| International data transfer rule SPDP Res. 2026-0004-R | In force | 1 |
| Financial technology service entities rule JPRF-F-2025-0155 | In force | 2 |
| Fintech risk management rule SB-2025-02323 | In force | 1 |
| Ecuador's national AI strategy EFIA-EC | Regulator guidance | 1 |
| AI regulation and promotion bill (archived) Archived AI bill | Lapsed or superseded | 1 |
| AI development, ethical use and governance bill Pending AI bill | Bill | 1 |
Key dates
- Estimated end of the transition: 12 months from entry into force, counted from signature because the Official Register date is missing · SPDP Res. 2026-0004-R
- Professional program becomes a requirement · SPDP Res. 2025-0028-R
Show past dates (17)
- Archived by the full Assembly · Archived AI bill
- First public report of the amendment (Official Register date still missing) · SPDP AI rule
- Amendment SPDP-SPD-2026-0037-R signed · SPDP AI rule
- Bill filed · Pending AI bill
- Publication in the Official Register and entry into force · SPDP AI rule
- Rule signed · SPDP Res. 2026-0004-R
- Published in the Official Register · EFIA-EC
- Private-sector registration deadline · SPDP Res. 2025-0028-R
- Agreement signed · EFIA-EC
- Signed and in force · SPDP Res. 2025-0041-R
- Published in Official Register No. 155 · SB-2025-02323
- Issued · SB-2025-02323
- Issued and in force · JPRF-F-2025-0155
- In force from signing · SPDP Res. 2025-0003-R
- Regulation published · LOPDP
- Penalties become enforceable · LOPDP
- Law published · LOPDP
Use cases with their own obligations in Ecuador
- Employees use generative AI (ChatGPT, Copilot, Gemini…)
- Coding assistants
- Customer service chatbot or assistant
- AI agents that take actions
- Generated or synthetic marketing content
- Hiring, evaluation or termination of staff
- Algorithmic worker management (shifts, tasks, pay)
- Worker monitoring
- Credit or creditworthiness scoring
- Insurance pricing or underwriting
- Diagnosis, triage or clinical support
- Admissions, grading or exam proctoring
- Biometrics, facial or emotion recognition
- Training or fine-tuning models on own data
- AI features inside vendor software
- Selling software or services that include AI
- Access to public services or benefits
- Other automated decisions with significant effects (housing, pricing, access to services)
Regulatory change alerts by country
Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.
- Changes to the rules of the countries you pick, when we add them to the registry.
- New application dates.
- No more than one email a week. Unsubscribe at any time.
It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.