Ecuador. Comprehensive data protection. Law
LOPDPOrganic Law on Personal Data Protection (Ley Orgánica de Protección de Datos Personales - LOPDP)
In force
§1Summary
- Synopsis
Ecuador's GDPR-modelled law with lawful bases, extensive rights, DPIAs, DPOs, breach notification and transfer rules, supervised by a dedicated superintendency that has begun issuing sanctions.
- Key themes
- Unique features
Turnover-percentage fines and very short breach deadlines (5 days to authority); fines also apply to public servants.
- SaaS relevance
Applies to controllers/processors outside Ecuador that process data of residents when targeting or monitoring them.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- SPDP and ARCOTEL within 5 days; individuals within 3 days of awareness of risk; processors to controller within 2 days
- DPO
- Conditional
- Cross-border transfers
- Adequacy, SCCs/safeguards (SPDP Res. 2025-0024), BCRs, authorisation
- Maximum penalty
- Up to 1% of prior-year turnover (serious); 0.1-0.7% (minor)
§3Dates
- Key dates
- Adopted
- In force
- Two-year transition; sanctions regime applicable from 2023-05-26; General Regulation (Decree 904) 2023-11-13; SPDP operational from 2024-04-23; SPDP resolutions 2025-2026 on transfers, DPO, legitimate interest
§4Text and authority
- Text
- Authoritative text spdp.gob.ec
- Authority
- Superintendencia de Protección de Datos Personales (SPDP)
§5Where it applies
- Domestic law of
- Ecuador
§6Sources and verification
- Verification
High confidence.
Official text link is SPDP home (Registro Oficial Supl. 459 of 2021-05-26).