Skip to content
AI Policy Generator

ESWhat applies

Worker monitoring in Ecuador: related rules

Using AI to track workers' activity, productivity, location, behavior or state through cameras, software or sensors. It clashes with privacy and dignity, so it requires proportionality and prior notice, and in the EU inferring emotions is banned.

Risk classification

JurisdictionLevelDateNote
EcuadorData protection—The data protection law requires an impact assessment for large-scale systematic monitoring.

Obligations related to this use case

Respect the right not to be subject to automated decisions

LOPDPLOPDP, arts. 20 y 21In force

Already applicable

When it relates
Organizations that use AI to profile people or make decisions with legal effects or that affect their rights.
What the rule provides
  • Tell people about this right no later than the first communication with them.
  • Let the person request a reasoned explanation, submit comments, learn the assessment criteria and the types and sources of data, and challenge the decision.
  • Do not include waivers of this right in standard-form contracts. Automated decisions about minors require express consent from their legal representative.
Typical evidence
  • Privacy notice stating the art. 20 right
  • Review request procedure and log
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP (Fifth Supplement 459), art. 20 (explanation, comments, criteria, challenge; disclose the right in the first communication; no waivers in standard-form contracts) and art. 21 (children and adolescents).

Run an impact assessment before high-risk processing

LOPDPLOPDP, art. 42; Reglamento LOPDP, arts. 29 a 32In force

Already applicable

When it relates
Mandatory before profiling people with legal effects, processing sensitive data at large scale or monitoring public areas at large scale (for example, AI video surveillance).
What the rule provides
  • Assess the impact before processing starts, with a description of the operations, justification of necessity and proportionality, risks and measures.
  • File the assessment with the Superintendency when it is mandatory; if unsure, you can ask the authority.
Typical evidence
  • Dated impact assessment and proof of filing
Verification
Verified in the official source on November 4, 2026Checked against the Official Register copies published by the SPDP: LOPDP, art. 42 (mandatory cases, before processing) and Regulation (Third Supplement 435), arts. 29-32 (query when in doubt, art. 31; filing with the Authority, art. 32).

AI impact assessment when the risk calls for it

SPDP AI ruleRes. SPDP-SPD-2026-0009-R, arts. 6 y 7.2, reformados por la SPDP-SPD-2026-0037-R; LOPDP, art. 42In force

Applies from March 10, 2026

When it relates
AI systems that profile people with significant effects or process sensitive, biometric or children's data.
What the rule provides
  • Carry out the impact assessment when the risk level requires it, before processing.
Typical evidence
  • Impact assessment of the AI system
Verification
Verified in the official source on November 4, 2026Checked against the text of Res. SPDP-SPD-2026-0009-R published by the SPDP, art. 7.2 (impact assessment "where applicable") and art. 6 as worded by 0037-R ("where appropriate, the impact assessment"), with LOPDP art. 42. Res. 0037-R confirms its publication in Official Register No. 240 of Mar 10, 2026.

Appoint and register a data protection officer

SPDP Res. 2025-0028-RLOPDP, art. 48; Reglamento LOPDP; Res. SPDP-SPD-2025-0028-R, arts. 11, 15 y 16 y disposiciones transitoriasIn force

Applies from December 31, 2025

When it relates
The public sector and 14 private activities, including finance and insurance, healthcare, telecom, education, private security, marketing with profiling and IT services, including AI.
What the rule provides
  • Appoint an independent officer with a degree and at least 5 years of experience; they cannot also be the compliance or information security officer.
  • Register them in the Superintendency's system; the private-sector deadline was Dec 31, 2025, so a new company should do it right away.
Typical evidence
  • Appointment record and proof of registration
Verification
Verified in the official source on November 4, 2026Checked against the text published by the SPDP: arts. 15.5 and 16 (cannot also be compliance or information security officer), private-sector registration from Nov 1 to Dec 31, 2025 (transitional provision) and art. 11 enforceable from Jan 1, 2029 (seventh provision). The degree and 5 years of experience come from the LOPDP Regulation.

Document the balancing test when relying on legitimate interest

SPDP Res. 2025-0041-RRes. SPDP-SPD-2025-0041-RIn force

Applies from November 7, 2025

When it relates
Organizations that process data with AI on the basis of legitimate interest, for example to train models, prevent fraud or personalize marketing.
What the rule provides
  • Apply the Superintendency's balancing methodology and document why the company's interest does not override people's rights.
Typical evidence
  • Signed legitimate interest analysis per processing activity
Verification
Verified in the official source on November 4, 2026Checked against the text published by the SPDP: art. 2 (mandatory for anyone relying on legitimate interest; private sector only) and annex with the methodology. In force since signature on Nov 7, 2025.

Related base documents

Related kits

Includes 5 documents

HR and AI Recruiting Kit

AI hiring policy, notice to workers and representatives, meaningful human oversight, DPIA and decision review for candidates and employees.

USD 129USD 215

Complete kit · available to buy

Includes 5 documents

Platforms and Algorithmic Management Kit

Algorithmic management notice to workers, human oversight, review of decisions on shifts, tasks or pay, a decision log and DPIA.

USD 129USD 215

Complete kit · available to buy

Find out what applies to you (free)Ecuador