Data Protection Officer Regulation (SPDP Res. 2025-0028-R)

Data Protection Officer Regulation

In forceSPDP Res. 2025-0028-R

Summary

Lists 14 private activities that must have a data protection officer, including IT and AI service providers, and sets up their registration.

The public sector and companies in the 14 listed activities.

Failing to appoint or register the officer is a serious violation under the LOPDP.

Official name: Resolución N.° SPDP-SPD-2025-0028-R, Reglamento del Delegado de Protección de Datos Personales
Official reference: Resolución SPDP-SPD-2025-0028-R, 30 de julio de 2025, vigente desde su suscripción
Regulator: Personal Data Protection Superintendency (SPDP)
Official source: Check the sourceHow we verify sources

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Appoint and register a data protection officer	LOPDP, art. 48; Reglamento LOPDP; Res. SPDP-SPD-2025-0028-R, arts. 11, 15 y 16 y disposiciones transitorias	In force	December 31, 2025	The public sector and 14 private activities, including finance and insurance, healthcare, telecom, education, private security, marketing with profiling and IT services, including AI.	Verified in the official source on November 4, 2026

LOPDP, art. 48; Reglamento LOPDP; Res. SPDP-SPD-2025-0028-R, arts. 11, 15 y 16 y disposiciones transitoriasIn force

Applies from December 31, 2025

When it relates: The public sector and 14 private activities, including finance and insurance, healthcare, telecom, education, private security, marketing with profiling and IT services, including AI.
What the rule provides: Appoint an independent officer with a degree and at least 5 years of experience; they cannot also be the compliance or information security officer.
Register them in the Superintendency's system; the private-sector deadline was Dec 31, 2025, so a new company should do it right away.
Typical evidence: Appointment record and proof of registration
Related base documents: Data Protection Officer Appointment Record
Verification: Verified in the official source on November 4, 2026Checked against the text published by the SPDP: arts. 15.5 and 16 (cannot also be compliance or information security officer), private-sector registration from Nov 1 to Dec 31, 2025 (transitional provision) and art. 11 enforceable from Jan 1, 2029 (seventh provision). The degree and 5 years of experience come from the LOPDP Regulation.