GRCLibrary.ai

Annex

Ecuador Privacy Regulatory Requirements

This annex defines the privacy regulatory requirements applicable to the tratamiento (processing) of personal data in Ecuador under the Ley Orgánica de Protección de Datos Personales (LOPDP) and its Reglamento General, issued by Decreto Ejecutivo 904. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure. The LOPDP applies to the tratamiento of personal data held in any type of medium, automated or not, and to every later form of use, except in the cases the same article excludes [Ley Art 2]. Without prejudice to the rules established in the international instruments ratified by the Ecuadorian State that concern this matter, it applies where the tratamiento takes place anywhere in the national territory, where the controller (responsable) or processor (encargado) is domiciled there, where a controller or processor not established in Ecuador processes the data of data subjects (titulares) residing in Ecuador and the processing relates to offering them goods or services, whether or not payment is required, or to monitoring their behaviour in Ecuador, and where Ecuadorian law applies to a controller or processor not domiciled in Ecuador by contract or by public international law [Ley Art 3].

Type
Annex
Version
0.0.5
Date
2026-10-27
Owner
Data Protection Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Privacy
Review frequency
Annual and upon material privacy or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Applicable law and regulatory authority
  • Principles, lawful basis, and consent
  • Data-subject rights
  • Cross-border transfers
  • Database registration and accountability
  • Security and breach
  • Enforcement and penalties
  • Employment and workforce monitoring
  • Limitations

Related documents