Risk management and impact assessment guide

In forceSPDP Res. 2025-0003-R

Summary

Sets mandatory principles for managing risks and assessing the impact of data processing, with a reference assessment format.

Public and private controllers and processors.

Fines of 0.1% to 0.7% (minor) and 0.7% to 1% (serious) of the prior fiscal year's turnover; for public officials, 1 to 20 basic salaries.

Official name: Resolución N.° SPDP-SPD-2025-0003-R, Guía de Gestión de Riesgos y Evaluación de Impacto del Tratamiento de Datos Personales
Official reference: Resolución SPDP-SPD-2025-0003-R, 29 de abril de 2025
Regulator: Personal Data Protection Superintendency (SPDP)
Official source: Check the sourceHow we verify sources

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Use a data risk management methodology	Res. SPDP-SPD-2025-0003-R, art. 2 (capítulo I de la guía)	In force	April 29, 2025	Public and private controllers and processors that process personal data.	Verified in the official source on November 4, 2026

Res. SPDP-SPD-2025-0003-R, art. 2 (capítulo I de la guía)In force

Applies from April 29, 2025

When it relates: Public and private controllers and processors that process personal data.
What the rule provides: Apply the mandatory risk management principles in chapter I; the chapter II procedures are a reference and you may use your own methodology.
Typical evidence: Approved risk methodology and assessments using it
Related base documents: AI Risk Management Procedure
Supporting documents: AI Impact-Risk Prioritization Matrix
Data Protection Impact Assessment (DPIA) for AI
Verification: Verified in the official source on November 4, 2026Checked against the text published by the SPDP: art. 2 (chapter I is mandatory and chapter II is for reference; risk analysis and impact assessment remain mandatory). In force since signature on Apr 29, 2025.