Cybersecurity - Ecuador

The Ley Orgánica para el Fortalecimiento de la Ciberseguridad was published in the fifth supplement of Registro Oficial No. 290 on 22 May 2026 and entered into force immediately, concluding a legislative process that began with the National Assembly's approval on 10 February 2026 and survived a partial presidential objection.

The law applies to public sector entities, digital service providers, and private legal entities responsible for critical digital infrastructure; natural persons are expressly excluded. It covers both domestic operations and cross-border digital services affecting Ecuador.

Covered entities must report cybersecurity incidents or attacks to competent authorities within 78 hours of becoming aware of them, a timeline broadly comparable to EU NIS2 obligations and significantly shorter than most Latin American peers.

Infractions are graded minor (0.1–0.7% of turnover for companies; 1–10 SBU for public officials), serious (0.7–1%; 10–20 SBU), and very serious (1–1.5%; 20–40 SBU), with penalties applicable to both public and private entities.

The law formalises the national CSIRT (Equipo de Respuesta a Incidentes de Seguridad Informática) under MINTEL oversight and aligns Ecuador's framework with ISO 27000 standards and the NIST Cybersecurity Framework, building on U.S.–Ecuador cyber-defence cooperation exercises (CIBEREC 2025).

Separately, the Organic Law for Personal Data Protection (LOPDP, 2021) requires data controllers to notify the Personal Data Protection Authority of a breach within five days of awareness; processors must alert controllers within two days. This data-protection channel operates in parallel with the new cybersecurity incident-reporting regime.