Other automated decisions with significant effects (housing, pricing, access to services) in Ecuador: related rules

Automated or AI-driven decisions that affect people outside employment and credit: housing rentals, personalized pricing, access to services, account blocking or legal services. They trigger rights regarding automated decisions under data protection laws and, in the US, consequential decision laws.

Risk classification

Jurisdiction	Level	Date	Note
Ecuador	Data protection	—	Data Protection Law Art. 20: right not to be subject to automated decisions with legal effects.

Obligations related to this use case

Respect the right not to be subject to automated decisions

LOPDPLOPDP, arts. 20 y 21In force

Already applicable

When it relates: Organizations that use AI to profile people or make decisions with legal effects or that affect their rights.
What the rule provides: Tell people about this right no later than the first communication with them.
Let the person request a reasoned explanation, submit comments, learn the assessment criteria and the types and sources of data, and challenge the decision.
Do not include waivers of this right in standard-form contracts. Automated decisions about minors require express consent from their legal representative.
Typical evidence: Privacy notice stating the art. 20 right
Review request procedure and log
Related base documents: Automated Decision Review Procedure
Supporting documents: Adverse Automated Decision Explanation Letter
AI Transparency and User Explanation Policy
AI User Rights Notice
Privacy Notice and Data Processing Policy with AI
Verification: Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP (Fifth Supplement 459), art. 20 (explanation, comments, criteria, challenge; disclose the right in the first communication; no waivers in standard-form contracts) and art. 21 (children and adolescents).

Run an impact assessment before high-risk processing

LOPDPLOPDP, art. 42; Reglamento LOPDP, arts. 29 a 32In force

Already applicable

When it relates: Mandatory before profiling people with legal effects, processing sensitive data at large scale or monitoring public areas at large scale (for example, AI video surveillance).
What the rule provides: Assess the impact before processing starts, with a description of the operations, justification of necessity and proportionality, risks and measures.
File the assessment with the Superintendency when it is mandatory; if unsure, you can ask the authority.
Typical evidence: Dated impact assessment and proof of filing
Related base documents: Data Protection Impact Assessment (DPIA) for AI
Supporting documents: Algorithmic Impact Assessment (AIA)
AI Risk Management Procedure
Verification: Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 42 (mandatory cases, before processing) and Regulation (Third Supplement 435), arts. 29-32 (query when in doubt, art. 31; filing with the Authority, art. 32).

AI impact assessment when the risk calls for it

SPDP AI ruleRes. SPDP-SPD-2026-0009-R, arts. 6 y 7.2, reformados por la SPDP-SPD-2026-0037-R; LOPDP, art. 42In force

Applies from March 10, 2026

When it relates: AI systems that profile people with significant effects or process sensitive, biometric or children's data.
What the rule provides: Carry out the impact assessment when the risk level requires it, before processing.
Typical evidence: Impact assessment of the AI system
Related base documents: Data Protection Impact Assessment (DPIA) for AI
Supporting documents: Algorithmic Impact Assessment (AIA)
Impact Assessment Summary Register
Verification: Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, art. 7.2 (impact assessment "where applicable") and art. 6 as worded by 0037-R ("where appropriate, the impact assessment"), with LOPDP art. 42. Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

Document the balancing test when relying on legitimate interest

SPDP Res. 2025-0041-RRes. SPDP-SPD-2025-0041-RIn force

Applies from November 7, 2025

When it relates: Organizations that process data with AI on the basis of legitimate interest, for example to train models, prevent fraud or personalize marketing.
What the rule provides: Apply the Superintendency's balancing methodology and document why the company's interest does not override people's rights.
Typical evidence: Signed legitimate interest analysis per processing activity
Related base documents: Legitimate Interest Assessment for AI
Supporting documents: AI Annex to the Record of Processing Activities
Verification: Verified in the official source on November 4, 2026Checked against the text published by the SPDP: art. 2 (mandatory for anyone relying on legitimate interest; private sector only) and annex with the methodology. In force since signature on Nov 7, 2025.