Skip to content
AI Policy Generator

ESWhat applies

Generated or synthetic marketing content in Ecuador: related rules

AI-generated text, images, video and audio for advertising, social media, catalogs or corporate communications. The risks are misleading the public, infringing third-party rights and making unsubstantiated AI claims.

Risk classification

Obligations related to this use case

Sign contracts with vendors that process data

LOPDPLOPDP, arts. 34 y 47, num. 10; Reglamento LOPDP, arts. 40 y 41In force

Already applicable

When it relates
Organizations using AI vendors that access personal data (generative AI tools, chatbots, AI-enabled software).
What the rule provides
  • Choose vendors that offer sufficient guarantees and sign contracts with confidentiality and data processing clauses.
Typical evidence
  • Signed processing agreements with each AI vendor
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 34 (processing by a processor is governed by a contract) and art. 47(10) (confidentiality contracts); Regulation, art. 40 (processor's sufficient guarantees) and art. 41 (written contract and its contents). Failing to sign them is a serious violation (LOPDP, art. 68).

Get information about the AI system from the vendor

SPDP AI ruleRes. SPDP-SPD-2026-0037-R, arts. 5 y 8, que reforma la SPDP-SPD-2026-0009-RIn force

Applies from September 14, 2026

When it relates
Organizations that use third-party AI systems with personal data.
What the rule provides
  • Request and keep the vendor's report on operation, limitations, risks and controls, and set out in the contract what access it has to the data.
Typical evidence
  • Vendor report and assessment questionnaire
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Content checked against the 0037-R text published by the SPDP: art. 5 requires the processor to give the controller information on operation, limitations, risks and controls; requesting it, keeping it and setting data access in the contract helps document this. The Official Register publication date of 0037-R, which determines when it takes effect, is still missing; the date used is the first public report (Sep 14, 2026).

Document the balancing test when relying on legitimate interest

SPDP Res. 2025-0041-RRes. SPDP-SPD-2025-0041-RIn force

Applies from November 7, 2025

When it relates
Organizations that process data with AI on the basis of legitimate interest, for example to train models, prevent fraud or personalize marketing.
What the rule provides
  • Apply the Superintendency's balancing methodology and document why the company's interest does not override people's rights.
Typical evidence
  • Signed legitimate interest analysis per processing activity
Verification
Verified in the official source on November 4, 2026Checked against the text published by the SPDP: art. 2 (mandatory for anyone relying on legitimate interest; private sector only) and annex with the methodology. In force since signature on Nov 7, 2025.

Related base documents

Related kits

Includes 4 documents

Generative AI Starter Kit

Four base documents to start with from day one: usage rules, intellectual property, a tool inventory and staff training.

USD 109USD 176

Complete kit · available to buy

Includes 5 documents

Marketing and Synthetic Media Kit

Labeling of generated content, voice and likeness consent, intellectual property and substantiation of AI advertising claims.

USD 99USD 155

Complete kit · available to buy

Find out what applies to you (free)Ecuador