International data transfer rule (SPDP Res. 2026-0004-R)

International data transfer rule

In forceSPDP Res. 2026-0004-R

Summary

Governs how data may be sent outside Ecuador, creates the transfer registry and gives 12 months to regularize existing transfers.

Organizations that transfer or disclose personal data to third parties, especially abroad.

Fines of 0.1% to 0.7% (minor) and 0.7% to 1% (serious) of the prior fiscal year's turnover; for public officials, 1 to 20 basic salaries.

Official name: Resolución N.° SPDP-SPD-2026-0004-R, Norma General de Transferencias o Comunicaciones Nacionales e Internacionales de Datos Personales
Official reference: Resolución SPDP-SPD-2026-0004-R, firmada el 28 de enero de 2026; rige desde su publicación en el Registro Oficial (fecha no confirmada)
Regulator: Personal Data Protection Superintendency (SPDP)
Official source: Check the sourceHow we verify sources

January 28, 2026Rule signed
January 28, 2027Estimated end of the transition: 12 months from entry into force, counted from signature because the Official Register date is missing

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Document and register international transfers	LOPDP, arts. 55 a 58; Res. SPDP-SPD-2026-0004-R, art. 4 y disposiciones transitorias	In force	January 28, 2026	Organizations that send personal data outside Ecuador, for example to cloud AI vendors.	Pending confirmation in the official source (last checked: November 4, 2026)

LOPDP, arts. 55 a 58; Res. SPDP-SPD-2026-0004-R, art. 4 y disposiciones transitoriasIn force

Applies from January 28, 2026

When it relates: Organizations that send personal data outside Ecuador, for example to cloud AI vendors.
What the rule provides: Use a valid mechanism: adequate country, recognition within the Andean Community, adequate safeguards (model clauses, binding corporate rules, certifications) or prior authorization.
Register transfers in the National Personal Data Registry once the Superintendency opens it (it has 12 months from the rule's entry into force) and keep contracts, impact assessments and security measures for at least 3 years.
For transfers made before the rule, notify them and file an adjustment plan within 12 months of its entry into force.
Typical evidence: File per vendor and proof of registration
Related base documents: International Data Transfer File for AI Services
Supporting documents: AI Data Processing Agreement (DPA)
AI Integrations and API Map
Verification: Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the text published by the SPDP (art. 4: documentation kept at least three years; transitional provisions: notice and adjustment plan within 12 months; fourth provision: National Registry within 12 months) and LOPDP arts. 55-58. The rule takes effect on publication in the Official Register, whose date was not confirmed; the date used (Jan 28, 2026) is the signature date.