Skip to content
AI Policy Generator

ESWhat applies

Ecuador · Resolution

General rule on data protection in AI systems

In forceSPDP AI rule

Summary

Ecuador's binding AI rule. It requires disclosing AI processing, managing risks, assessing impact when needed, listing AI in the processing record, applying security measures and auditing systems according to risk. The 2026 amendment clarifies which vendors are covered and requires them to inform their clients about the system.

Who it applies to

Controllers and processors that develop, train, deploy or supply AI that processes data of people in Ecuador, wherever the system or vendor is located.

Penalties

Penalized under the LOPDP regime (up to 1% of turnover). The Superintendency can audit systems and order corrective or precautionary measures.

Official name
Resolución N.° SPDP-SPD-2026-0009-R, Norma General para la Garantía del Derecho de Protección de Datos Personales en el Uso de Sistemas de Inteligencia Artificial (reformada por la Resolución N.° SPDP-SPD-2026-0037-R)
Official reference
Registro Oficial N.° 240, 10 de marzo de 2026 (firmada el 12 de febrero de 2026); reformada por la Res. SPDP-SPD-2026-0037-R, firmada el 9 de septiembre de 2026 y vigente desde su publicación en el Registro Oficial (fecha no confirmada)
Regulator
Personal Data Protection Superintendency (SPDP)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Tell people their data is processed with AIRes. SPDP-SPD-2026-0009-R, arts. 4 y 5.1In forceMarch 10, 2026Controllers and processors whose AI systems process data of people in Ecuador, even if the system or vendor is abroad.Verified in the official source on November 4, 2026
Manage risks before developing or deploying AIRes. SPDP-SPD-2026-0009-R, arts. 5.2, 6 y 7, reformados por la SPDP-SPD-2026-0037-RIn forceMarch 10, 2026Controllers and processors that develop, train or deploy AI with personal data.Verified in the official source on November 4, 2026
AI impact assessment when the risk calls for itRes. SPDP-SPD-2026-0009-R, arts. 6 y 7.2, reformados por la SPDP-SPD-2026-0037-R; LOPDP, art. 42In forceMarch 10, 2026AI systems that profile people with significant effects or process sensitive, biometric or children's data.Verified in the official source on November 4, 2026
Include AI processing in the record of processing activitiesRes. SPDP-SPD-2026-0009-R, arts. 5.4 y 7.1In forceMarch 10, 2026Controllers that use AI with personal data.Verified in the official source on November 4, 2026
Apply security measures to AI systemsRes. SPDP-SPD-2026-0009-R, arts. 5.3 y 7In forceMarch 10, 2026Controllers and processors using AI with personal data.Verified in the official source on November 4, 2026
Audit AI systems according to their risk levelRes. SPDP-SPD-2026-0009-R, arts. 5.5, 7.3 y 10In forceMarch 10, 2026Controllers and processors using AI with personal data. The Superintendency can also audit systems and order corrective measures.Verified in the official source on November 4, 2026
Delete or anonymize data once the purpose is fulfilledLOPDP, arts. 10 (principio de conservación) y 15; Res. SPDP-SPD-2026-0009-R, art. 3In forceMarch 10, 2026Controllers and processors that use or train AI with personal data.Verified in the official source on November 4, 2026
AI vendor duties toward its clientRes. SPDP-SPD-2026-0037-R, arts. 1, 5, 8 y disposiciones generales, que reforma la SPDP-SPD-2026-0009-RIn forceSeptember 14, 2026Companies that provide, develop or maintain AI systems that process their clients' data.Pending confirmation in the official source (last checked: November 4, 2026)
Get information about the AI system from the vendorRes. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn forceSeptember 14, 2026Organizations that use third-party AI systems with personal data.Pending confirmation in the official source (last checked: November 4, 2026)

Tell people their data is processed with AI

Res. SPDP-SPD-2026-0009-R, arts. 4 y 5.1In force

Applies from March 10, 2026

When it relates
Controllers and processors whose AI systems process data of people in Ecuador, even if the system or vendor is abroad.
What the rule provides
  • Disclose that processing relies on AI, its purposes and whether it is automated.
  • Uphold the rights to information, to object and not to be subject to automated decisions.
Typical evidence
  • Privacy or AI notice with the required information
Verification
Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, arts. 4 (rights to information, objection and not to be subject to automated decisions) and 5.1 (disclose AI use, its purposes and automated nature). Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

Manage risks before developing or deploying AI

Res. SPDP-SPD-2026-0009-R, arts. 5.2, 6 y 7, reformados por la SPDP-SPD-2026-0037-RIn force

Applies from March 10, 2026

When it relates
Controllers and processors that develop, train or deploy AI with personal data.
What the rule provides
  • Analyze and manage processing risks before development, in writing.
  • Review the analysis when the system, data or purpose changes; it helps document the ongoing, continuous management that art. 7 calls for.
Typical evidence
  • Dated risk analysis per system
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, arts. 5.2, 6 (risk management before development, as worded by 0037-R) and 7 (ongoing, continuous measures). Reviewing the analysis after changes is a suggested practice. Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

AI impact assessment when the risk calls for it

Res. SPDP-SPD-2026-0009-R, arts. 6 y 7.2, reformados por la SPDP-SPD-2026-0037-R; LOPDP, art. 42In force

Applies from March 10, 2026

When it relates
AI systems that profile people with significant effects or process sensitive, biometric or children's data.
What the rule provides
  • Carry out the impact assessment when the risk level requires it, before processing.
Typical evidence
  • Impact assessment of the AI system
Verification
Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, art. 7.2 (impact assessment "where applicable") and art. 6 as worded by 0037-R ("where appropriate, the impact assessment"), with LOPDP art. 42. Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

Include AI processing in the record of processing activities

Res. SPDP-SPD-2026-0009-R, arts. 5.4 y 7.1In force

Applies from March 10, 2026

When it relates
Controllers that use AI with personal data.
What the rule provides
  • Add each AI processing activity to the record and describe the automated decisions it produces.
Typical evidence
  • Processing record with AI annex
Verification
Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, arts. 5.4 (add AI processing to the record of processing activities) and 7.1 (add automated decisions with legal effects or that affect rights). Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

Apply security measures to AI systems

Res. SPDP-SPD-2026-0009-R, arts. 5.3 y 7In force

Applies from March 10, 2026

When it relates
Controllers and processors using AI with personal data.
What the rule provides
  • Adopt administrative, technical, physical, organizational and legal measures proportionate to the AI system's risk.
Typical evidence
  • Documented security controls for each system
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, arts. 5.3 and 7 (administrative, technical, physical, organizational and legal measures based on data categories and volume). Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

Audit AI systems according to their risk level

Res. SPDP-SPD-2026-0009-R, arts. 5.5, 7.3 y 10In force

Applies from March 10, 2026

When it relates
Controllers and processors using AI with personal data. The Superintendency can also audit systems and order corrective measures.
What the rule provides
  • Audit the overall operation of each AI system according to its risk level (arts. 5.5 and 7.3).
  • Keep audit evidence to hand over if the Superintendency asks for it; the Superintendency can also audit systems and impose corrective or precautionary measures (art. 10).
Typical evidence
  • Audit plan and reports
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, art. 5.5 (controllers "shall audit the overall operation of the system… based on the level of risk"), art. 7.3 ("shall carry out audits of the systems") and art. 10 (SPDP audits). Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

Delete or anonymize data once the purpose is fulfilled

LOPDP, arts. 10 (principio de conservación) y 15; Res. SPDP-SPD-2026-0009-R, art. 3In force

Applies from March 10, 2026

When it relates
Controllers and processors that use or train AI with personal data.
What the rule provides
  • Delete, block or anonymize data once the purpose is fulfilled or the retention period ends, including data used to train models, since the AI rule refers back to the LOPDP principles.
Typical evidence
  • Retention policy and deletion records
Related base documents
Verification
Verified in the official source on November 4, 2026Checked against the official copies published by the SPDP: LOPDP, art. 10 (retention principle: deletion or periodic review periods) and art. 15 (right to erasure). Res. SPDP-SPD-2026-0009-R does not regulate deletion itself; its art. 3 refers to the LOPDP principles.

AI vendor duties toward its client

Res. SPDP-SPD-2026-0037-R, arts. 1, 5, 8 y disposiciones generales, que reforma la SPDP-SPD-2026-0009-RIn force

Applies from September 14, 2026

When it relates
Companies that provide, develop or maintain AI systems that process their clients' data.
What the rule provides
  • Comply with the rule in the phases where you have access, visibility or effective control over the data.
  • If you claim no such access, keep evidence for the Superintendency.
  • Inform the client about how the system works, its relevant limitations, foreseeable risks and control measures, without revealing trade secrets.
Typical evidence
  • Report on operation, limitations and risks delivered to the client
  • Evidence of the scope of data access
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the text of Res. SPDP-SPD-2026-0037-R published by the SPDP: arts. 1 and 3-8 (processors with access, visibility or effective control), art. 5 (inform the controller) and general provisions one and two. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).

Get information about the AI system from the vendor

Res. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn force

Applies from September 14, 2026

When it relates
Organizations that use third-party AI systems with personal data.
What the rule provides
  • Request and keep the vendor's report on operation, limitations, risks and controls, and set out in the contract what access it has to the data.
Typical evidence
  • Vendor report and assessment questionnaire
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the 0037-R text published by the SPDP: art. 5 requires the processor to give the controller information on operation, limitations, risks and controls; requesting it, keeping it and setting data access in the contract helps document this. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)