Skip to content
AI Policy Generator

ESWhat applies

Ecuador · Law

Organic Personal Data Protection Law and its regulation

In forceLOPDP

Summary

General personal data law. For AI, the key parts are the right not to be subject to automated decisions, mandatory impact assessments, the processing record, 5-day breach notification and vendor contracts.

Who it applies to

Any public or private organization that processes personal data in Ecuador or about people in Ecuador.

Penalties

Fines of 0.1% to 0.7% (minor) and 0.7% to 1% (serious) of the prior fiscal year's turnover; for public officials, 1 to 20 basic salaries.

Official name
Ley Orgánica de Protección de Datos Personales y su Reglamento General (Decreto Ejecutivo N.° 904)
Official reference
Quinto Suplemento del Registro Oficial N.° 459, 26 de mayo de 2021; Reglamento: Tercer Suplemento del Registro Oficial N.° 435, 13 de noviembre de 2023
Regulator
Personal Data Protection Superintendency (SPDP)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Respect the right not to be subject to automated decisionsLOPDP, arts. 20 y 21In forceAlready applicableOrganizations that use AI to profile people or make decisions with legal effects or that affect their rights.Verified in the official source on November 4, 2026
Run an impact assessment before high-risk processingLOPDP, art. 42; Reglamento LOPDP, arts. 29 a 32In forceAlready applicableMandatory before profiling people with legal effects, processing sensitive data at large scale or monitoring public areas at large scale (for example, AI video surveillance).Verified in the official source on November 4, 2026
Keep a record of processing activitiesReglamento LOPDP, arts. 38 y 39In forceAlready applicableMandatory for controllers with 100 or more workers and, below that, when processing is risky, not occasional or includes sensitive data; in practice, almost any ongoing AI use with personal data.Verified in the official source on November 4, 2026
Report breaches within 5 daysLOPDP, art. 43; Reglamento LOPDP, arts. 24 a 28In forceAlready applicableAny organization processing personal data in Ecuador, including breaches in AI systems.Verified in the official source on November 4, 2026
Sign contracts with vendors that process dataLOPDP, arts. 34 y 47, num. 10; Reglamento LOPDP, arts. 40 y 41In forceAlready applicableOrganizations using AI vendors that access personal data (generative AI tools, chatbots, AI-enabled software).Verified in the official source on November 4, 2026

Respect the right not to be subject to automated decisions

LOPDP, arts. 20 y 21In force

Already applicable

When it relates
Organizations that use AI to profile people or make decisions with legal effects or that affect their rights.
What the rule provides
  • Tell people about this right no later than the first communication with them.
  • Let the person request a reasoned explanation, submit comments, learn the assessment criteria and the types and sources of data, and challenge the decision.
  • Do not include waivers of this right in standard-form contracts. Automated decisions about minors require express consent from their legal representative.
Typical evidence
  • Privacy notice stating the art. 20 right
  • Review request procedure and log
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP (Fifth Supplement 459), art. 20 (explanation, comments, criteria, challenge; disclose the right in the first communication; no waivers in standard-form contracts) and art. 21 (children and adolescents).

Run an impact assessment before high-risk processing

LOPDP, art. 42; Reglamento LOPDP, arts. 29 a 32In force

Already applicable

When it relates
Mandatory before profiling people with legal effects, processing sensitive data at large scale or monitoring public areas at large scale (for example, AI video surveillance).
What the rule provides
  • Assess the impact before processing starts, with a description of the operations, justification of necessity and proportionality, risks and measures.
  • File the assessment with the Superintendency when it is mandatory; if unsure, you can ask the authority.
Typical evidence
  • Dated impact assessment and proof of filing
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 42 (mandatory cases, before processing) and Regulation (Third Supplement 435), arts. 29-32 (query when in doubt, art. 31; filing with the Authority, art. 32).

Keep a record of processing activities

Reglamento LOPDP, arts. 38 y 39In force

Already applicable

When it relates
Mandatory for controllers with 100 or more workers and, below that, when processing is risky, not occasional or includes sensitive data; in practice, almost any ongoing AI use with personal data.
What the rule provides
  • Record each processing activity with purposes, data and people categories, recipients, use of profiling, international transfers, legal basis, retention periods and security measures.
Typical evidence
  • Up-to-date processing record with AI processing identified
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: Regulation (Third Supplement 435), art. 38 (controllers with 100 or more workers; contents of the record) and art. 39 (fewer workers if there is risk, non-occasional processing or sensitive data).

Report breaches within 5 days

LOPDP, art. 43; Reglamento LOPDP, arts. 24 a 28In force

Already applicable

When it relates
Any organization processing personal data in Ecuador, including breaches in AI systems.
What the rule provides
  • Notify the Personal Data Protection Superintendency and the telecom regulator (ARCOTEL) within 5 business days at the latest.
  • Include the nature of the breach, affected people, systems, cause, volume, measures and risk assessment. Processors must alert the controller.
Typical evidence
  • Incident log and notifications sent
Supporting documents
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 43 (SPDP and ARCOTEL within 5 days; the processor tells the controller within 2 days) and Regulation, arts. 24-28 (notice contents, art. 26).

Sign contracts with vendors that process data

LOPDP, arts. 34 y 47, num. 10; Reglamento LOPDP, arts. 40 y 41In force

Already applicable

When it relates
Organizations using AI vendors that access personal data (generative AI tools, chatbots, AI-enabled software).
What the rule provides
  • Choose vendors that offer sufficient guarantees and sign contracts with confidentiality and data processing clauses.
Typical evidence
  • Signed processing agreements with each AI vendor
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 34 (processing by a processor is governed by a contract) and art. 47(10) (confidentiality contracts); Regulation, art. 40 (processor's sufficient guarantees) and art. 41 (written contract and its contents). Failing to sign them is a serious violation (LOPDP, art. 68).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)