Data protection & privacy law in Ecuador (2026)

The Superintendencia published Resolution SPDP-SPD-2026-0004-R establishing the general norm for cross-border personal data transfers, and Resolution SPDP-SPD-2026-0009-R requiring any organization using AI systems to process Ecuadorian personal data to adopt a risk-based compliance approach under the LOPDP — extending the framework explicitly to automated decision-making.

The SPDP imposed its first significant administrative fines — USD 259,644 on professional football league LigaPro and USD 194,856 on the Ecuadorian Football Federation — for processing spectators' personal data via digital event-registration platforms without valid informed consent, establishing precedent and signalling active enforcement.

Per Resolution SPDP-SPD-2025-0028-R, private-sector entities in designated sectors (financial, insurance, education) were required to formally appoint and register their Data Protection Delegate (Delegado de Protección de Datos) with the SPDP during this 60-day window; failure constitutes a legal-security violation under the LOPDP.

Resolution SPDP-SPD-2025-0030-R defined technical standards for data pseudonymisation, anonymisation, blocking, and deletion, providing controllers with concrete operational requirements to satisfy data-minimisation and retention obligations under the LOPDP.

Resolution SPDP-SPD-2025-0028-R established the complete regulatory framework for Delegados de Protección de Datos, covering which entities must appoint one, required qualifications, functional independence, duties, and the SPDP registration process — mirroring GDPR Art. 37-39 obligations in the Ecuadorian context.

Resolution SPDP-SPDP-2024-0001-R approved the Superintendencia's provisional Organic Statute of Organisational Management, marking the regulator's first formal act and the start of its operational existence — more than three years after the LOPDP created it on paper.

President Noboa signed Decreto Ejecutivo No. 904, issuing the Reglamento General de la LOPDP. The 14-chapter regulation detailed procedures for exercising data-subject rights (access, rectification, deletion, portability, opposition), breach notification timelines, SPDP procedural rules, and the public data-processing register — operationalising the law's skeleton into enforceable obligations.

The two-year compliance transition period granted by the LOPDP expired, making all obligations — including administrative fines reaching up to 1% (minor), 2% (serious), or 5% (very serious) of the liable entity's annual turnover — immediately applicable to controllers and processors throughout Ecuador.

Researchers at vpnMentor discovered an unsecured Elasticsearch server run by analytics firm Novaestrat, exposing detailed civil-registry, financial, vehicle, and employment records on virtually the entire Ecuadorian population — including ~7 million minors. Authorities arrested Novaestrat's manager; the incident became the direct legislative catalyst for drafting and expediting the LOPDP.

Ecuador's Constitution of Montecristi, approved by national referendum, embedded an autonomous constitutional right to personal data protection (Art. 66.19) and created the habeas data guarantee (Art. 92), following the European model of data protection as an independent fundamental right. Any person could invoke habeas data before any court to access, correct, or delete their data held by public or private entities — the constitutional foundation on which all subsequent statute law was built.