Ecuador

Article 3 of the Organic Law on Personal Data Protection sets four triggers: processing carried out in Ecuadorian territory; a controller or processor established in Ecuador; processing of data belonging to people resident in Ecuador by a controller or processor outside Ecuador where the activity is offering goods or services to them or monitoring their behaviour in Ecuador; and where a treaty makes Ecuadorian law apply. Article 3 of the 2023 General Regulation adds the local-representative duty: 'Los responsables y encargados del tratamiento de datos personales no establecidos en el Ecuador deberan designar un apoderado especial en el Ecuador con residencia en el pais.' The only carve-out is occasional processing that does not involve large-scale processing of special-category data. The Superintendency issued a binding technical guide for registering that representative on 6 September 2024 (Resolution SPDP-SPDP-2024-0002-R) with a six-month deadline running from publication in the Official Register. The guide's sting is that where no representative is registered, anyone who appears to be acting on the foreign company's behalf in Ecuador can be held administratively responsible for the processing.

General rating: conditional. Articles 55 to 58 of the Organic Law on Personal Data Protection allow an international transfer where the destination has been declared to have an adequate level of protection, or where the exporter puts adequate safeguards in place, or under approved binding corporate rules. The Superintendency's General Rule on national and international transfers, Resolution SPDP-SPD-2026-0004-R of 28 January 2026, fleshes this out and adds approved codes of conduct and individual authorisation for exceptional cases. Sector by sector, checked on 19 August 2026: - Banking and payments: no storage-location rule found. The Superintendency of Banks regulates operational risk and third-party services, and the Financial Policy Board's fintech rules (Resolution JPRF-F-2023-076) expressly contemplate cloud computing without any territorial limit. Rating: conditional. - Credit reference data: closed. Private credit bureaux were abolished; the Superintendency of Banks runs the Credit Data Registry and is the only body authorised to hold and deliver that information. - Insurance and securities: no storage-location rule found; supervised by the Superintendency of Companies, Securities and Insurance. Rating: conditional, low confidence — see the unconfirmed list. - Health: no storage-location rule found. The Telehealth Technical Standard of 28 October 2025 requires custody, confidentiality and availability of records and points back to the general privacy law, but does not say where the data must sit. Rating: conditional. - Telecoms: no storage-location rule found. Operators must guarantee the secrecy of communications, protect subscriber data, and keep service information for as long as the regulations require. The regulator inspects where subscriber data is stored, but does not require it to be in Ecuador. Rating: conditional. - Government cloud: no storage-location rule found. The Government Information Security Scheme of 8 February 2024 sets security controls for public bodies with no residency requirement. - Mapping and geospatial: no storage or export rule found, but doing cartographic work in Ecuador at all needs a permit from the Military Geographic Institute. - Online gambling: no data rule found. None of these are 'there is no rule' statements. They are 'no rule found as at 19 August 2026'.

Resolution SPDP-SPD-2026-0004-R sets the machinery. Adequacy findings are made by the Superintendency, published in the Official Register and listed in the National Register of Personal Data Protection: 'Se inscribira, ademas, en el Registro Nacional de Proteccion de Datos Personales, que contendra el listado publico de paises, organizaciones internacionales...'. As at 19 August 2026 that public list is empty — no adequacy decision has been located. The rule expressly accepts the Ibero-American Data Protection Network model contract clauses as 'validas y suficientes para legitimar las transferencias o comunicaciones internacionales' without prior approval, which is the practical route for most companies. Binding corporate rules and codes of conduct are approved by the Superintendency and last four years with annual monitoring. Individual authorisation is reserved for exceptional cases and requires a full risk and impact analysis. Registration is the real operational burden: individual transfers must be entered in the National Register at least ten days before the operation, and organisations relying on adequacy or safeguards must file a consolidated annual report. A first transitional provision gives twelve months to declare transfers that were already running and to submit an adaptation plan, with no sanctions during that window if the plan is filed and implemented.

The Superintendency was created by the 2021 privacy law and staffed through the Council for Citizen Participation and Social Control's appointment process, which concluded in April 2024. Enforcement evidence, from the regulator's own site: four sanctioning resolutions published against the Federacion Ecuatoriana de Futbol and the Liga Profesional de Futbol del Ecuador (RES-SPDP-ICS-2025-0002, -0003, -0005 and -0006). Announced amounts include about 259,600 US dollars and about 194,900 US dollars in December 2025, and about 95,500 US dollars and about 194,500 US dollars in January 2026, with orders to notify 14,398 affected people and to delete unlawfully obtained consent records. The regulator also publishes general rules at a steady clip — more than a dozen in 2025 and at least nine in 2026 — and issues public alerts. That is an active regulator, not a dormant one, though not yet an aggressive one: the caseload so far is small and concentrated. Other enforcers: the Telecommunications Regulation and Control Agency inspects operators' handling of subscriber data; the Superintendency of Banks runs the Credit Data Registry; the Ministry of Telecommunications is the lead body for the new cybersecurity law.

Ceiling. Article 10 of the privacy law states the storage-limitation principle: 'Los datos personales seran conservados durante un tiempo no mayor al necesario para cumplir con la finalidad.' Article 15 gives a right to deletion which the controller must action within fifteen days where the processing was unlawful, the purpose is spent, consent was withdrawn or the retention period has ended. Floor. Article 96(1)(c) of the Tax Code requires taxpayers to keep books and accounting records 'mientras la obligacion tributaria no este prescrita'. Article 94 fixes the assessment window at three years from the date of the return, six years where no return or an incomplete return was filed, and one year to re-check an assessment already made. Telecom operators must keep service-related information for the period set in the sector regulations rather than a period fixed in the statute. Health records are governed by the Ministry of Public Health's clinical-record rules; we could not open the governing manual to confirm the exact period, so it is listed as unconfirmed. Conflict. The privacy law's storage-limitation principle bends to a legal obligation to retain: retention required by another law is a lawful basis in its own right, so the tax floor beats the privacy ceiling for the documents it covers. The safe pattern is to retain the tax-relevant document set for the statutory window and delete everything else on the shorter privacy clock.

Article 43 of the privacy law: notify 'tan pronto sea posible, y a mas tardar en el termino de cinco (5) dias despues de que haya tenido constancia' — 'termino' means working days in Ecuadorian practice, so five working days, not five calendar days. The same article routes the notification to the telecommunications regulator as well where a telecom provider is involved. Article 46 requires notification to the affected individual without delay and within three days of learning of the risk. Getting these the wrong way round is the classic Ecuadorian mistake: most global playbooks assume the regulator clock is the tight one. A draft general rule on breach notification was published for consultation in May 2026. It would move notifications onto the National Personal Data Protection System, run an automated severity triage before human review, and require notification to the public through at least two mass-media channels. It is a draft with no legal effect. The Organic Law for the Strengthening of Cybersecurity was published in the Official Register on 22 May 2026 and applies to public bodies, digital service providers and private operators of critical digital infrastructure. It leaves response times, coordination protocols and reporting formats to secondary regulation, and gives twelve months to stand up the national incident response team. Treat it as a clock that has not started ticking yet.

1. Article 46 gives three days to tell affected people; article 43 gives five to tell the regulator. Both are counted in working days. 2. Article 86 of the 2023 General Regulation requires registration in the National Register of Personal Data Protection within ten days of starting the processing. Article 64 of the 2026 transfers rule requires each international transfer to be registered at least ten days before it happens, plus a consolidated annual report where you rely on adequacy or safeguards. A routine engineering decision to move a workload to a new region can therefore be unlawful for want of a filing. 3. Article 39 of the General Regulation makes a data protection delegate compulsory for any controller or processor with one hundred or more employees, and for smaller ones whose processing is risky, non-occasional or involves special categories. A twelve-person Ecuadorian subsidiary of a global group can be caught by the second limb. 4. The 2024 technical guide on registering a special attorney states that where a foreign controller has not registered one, 'todas las personas naturales o juridicas que, segun las circunstancias, aparentaren actuar u obrar por cuenta de los sujetos regulados' answer administratively for the processing. Local distributors and staff become the target. 5. Fines are set as a percentage of the previous financial year's turnover: 0.1% to 0.7% for minor infringements and 0.7% to 1% for serious ones, with 'volumen de negocio' defined as revenue from sales and services in the last financial year net of value added tax and related direct taxes. Public officials are fined in multiples of the unified basic salary instead — one to ten for minor breaches, ten to twenty for serious ones. The Superintendency published its calculation methodology on 16 July 2025, so the numbers are formulaic rather than negotiable. 6. Bonus trap for anyone doing survey, drone or mapping work: cartographic activity in Ecuador needs a registration and authorisation from the Military Geographic Institute, including for foreign entities, under a 1978 cartography law that predates everything else here.

Dated items: - By 22 May 2027: the national computer security incident response team must be organised under the Organic Law for the Strengthening of Cybersecurity, and the secondary regulation setting response times, coordination protocols and reporting formats is due. Until then the law is in force but its operational duties are not. - Early 2027: the twelve-month transitional window in the 2026 transfers rule closes. Organisations that declared existing transfers and filed an adaptation plan are protected from sanctions during that window; after it, they are not. - Undated: a draft general rule on personal data breach notification (published May 2026) and a draft general rule on biometric data (published March 2026) are both out for comment and would add duties if adopted. Neither is binding. - The Superintendency has also issued a rule on reviewing and evaluating the privacy law itself, which points at statutory reform proposals but does not itself change the law. Dormant switches — powers already held that can change the picture with no consultation: 1. The adequacy list. The Superintendency can declare a country adequate, or decline to, purely by resolution. Today it is empty, which means everyone is on contractual safeguards; a single decision could reroute an entire market's compliance. 2. Refusal or revocation of individual transfer authorisations. The exceptional-case route is discretionary and the regulator has already shown it will impose corrective measures. 3. Corrective measures short of a fine. The privacy law lets the regulator order changes to processing; in the football cases it ordered deletion of consent records and mass notification of individuals, which is commercially heavier than the fines. 4. The cybersecurity regulator's power to set incident reporting deadlines by secondary regulation, with no fixed floor in the statute.