Ecuador
SubstantialOrganic Law on the Protection of Personal Data (LOPDP) 2021
Authority: Superintendence of Personal Data Protection | Enforcement: Pending | Enacted: May 2023
Overview
Ecuador enacted its comprehensive data protection law in 2021, with a two-year implementation period ending May 2023. The LOPDP is GDPR-inspired and establishes a dedicated Superintendence. Full enforcement is ramping up.
14-Topic Coverage
Data Protection Authority
Pending EnforcementSuperintendence of Personal Data Protection established. Operational capacity building.
Consent Requirements
Fully AddressedConsent required as primary basis. Must be free, specific, informed, and unambiguous.
Data Subject Rights
Fully AddressedRights to access, rectification, deletion, opposition, portability, and suspension.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with appropriate safeguards.
Breach Notification
Fully AddressedMust notify Superintendence and affected individuals within 72 hours.
DPO Requirements
Fully AddressedDPO required for public bodies and certain private sector organisations.
Children's Data
Fully AddressedEnhanced protections. Parental consent for children under 15.
Penalties & Enforcement
Fully AddressedFines from 0.1% to 1% of annual revenue. Serious infringements up to 1%.
Sector-Specific Rules
Partially AddressedSB financial data rules, health data regulations.
Cookie/Tracking
Partially AddressedGeneral consent requirements apply.
AI & Automated Decisions
Partially AddressedRight to not be subject to solely automated decisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Fully AddressedLaw applies to both public and private sector.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Ecuador's regulations.
Book a Consultation