Ecuador

The Organic Law on Personal Data Protection sets four triggers. Data handled inside Ecuadorian territory. A company based in Ecuador. Data about people living in Ecuador, handled by a company outside Ecuador. That applies where you offer them goods or services, or track what they do in Ecuador. And cases where a treaty makes Ecuadorian law apply. The 2023 General Regulation adds the local-representative duty: 'Los responsables y encargados del tratamiento de datos personales no establecidos en el Ecuador deberan designar un apoderado especial en el Ecuador con residencia en el pais.' The only exception is occasional use of data that does not involve large amounts of special-category data. The Superintendency issued a binding technical guide for registering that representative on 6 September 2024 (Resolution SPDP-SPDP-2024-0002-R). It set a six-month deadline running from publication in the Official Register. Here is the sting. If you register no representative, anyone who appears to act on your behalf in Ecuador can be held responsible for your use of data.

The general answer is that it depends. The Organic Law on Personal Data Protection allows a transfer abroad in three cases. The destination has been officially declared to protect data well enough. Or you put adequate safeguards in place. Or you use approved group-wide rules. The Superintendency's General Rule on national and international transfers, Resolution SPDP-SPD-2026-0004-R of 28 January 2026, fills this out. It adds approved codes of conduct, and individual permission for exceptional cases. Industry by industry, checked on 19 August 2026: - Banking and payments: we found no rule about where data must sit. The Superintendency of Banks regulates operational risk and third-party services. The Financial Policy Board's fintech rules (Resolution JPRF-F-2023-076) expressly allow cloud computing, with no limit on location. Conditions apply. - Credit reference data: closed. Private credit bureaux were abolished. The Superintendency of Banks runs the Credit Data Registry, and is the only body allowed to hold and hand out that information. - Insurance and securities: we found no rule about where data must sit. The Superintendency of Companies, Securities and Insurance supervises. Conditions apply, but our confidence is low. See the unconfirmed list. - Health: we found no rule about where data must sit. The Telehealth Technical Standard of 28 October 2025 requires custody, confidentiality and availability of records, and points back to the general privacy law. It does not say where the data must sit. Conditions apply. - Telecoms: we found no rule about where data must sit. Operators must guarantee the secrecy of communications, protect subscriber data, and keep service information for as long as the rules require. The regulator inspects where subscriber data is stored, but does not require it to be in Ecuador. Conditions apply. - Government cloud: we found no rule about where data must sit. The Government Information Security Scheme of 8 February 2024 sets security controls for public bodies, with no rule about the country. - Mapping and geospatial: we found no storage or export rule. But doing any cartographic work in Ecuador needs a permit from the Military Geographic Institute. - Online gambling: we found no data rule. None of these say 'there is no rule'. They say 'we found no rule as at 19 August 2026'.

Resolution SPDP-SPD-2026-0004-R sets out how this works. The Superintendency decides which countries protect data well enough. It publishes those decisions in the Official Register and lists them in the National Register of Personal Data Protection: 'Se inscribira, ademas, en el Registro Nacional de Proteccion de Datos Personales, que contendra el listado publico de paises, organizaciones internacionales...'. As at 19 August 2026 that public list is empty. We found no decision naming a country. The rule expressly accepts the Ibero-American Data Protection Network model contract clauses as 'validas y suficientes para legitimar las transferencias o comunicaciones internacionales', with no prior approval needed. That is the route most companies use. Group-wide rules and codes of conduct are approved by the Superintendency. They last four years, with annual monitoring. Individual permission is kept for exceptional cases, and needs a full risk and impact analysis. Registration is the real day-to-day burden. Individual transfers must go into the National Register at least ten days before they happen. If you rely on a safe-country finding or on safeguards, you also file one combined annual report. A transitional rule gives you twelve months to declare transfers that were already running, and to submit a plan to bring them into line. There are no penalties during that window if you file the plan and carry it out.

The Superintendency was created by the 2021 privacy law. It was staffed through the Council for Citizen Participation and Social Control's appointment process, which ended in April 2024. Here is the enforcement evidence, from the regulator's own site. It published four sanctioning resolutions against the Federacion Ecuatoriana de Futbol and the Liga Profesional de Futbol del Ecuador (RES-SPDP-ICS-2025-0002, -0003, -0005 and -0006). The announced amounts include about 259,600 US dollars and about 194,900 US dollars in December 2025. Then about 95,500 US dollars and about 194,500 US dollars in January 2026. It also ordered them to notify 14,398 affected people, and to delete consent records obtained unlawfully. The regulator publishes general rules steadily: more than a dozen in 2025 and at least nine in 2026. It also issues public alerts. So this is an active regulator, not a sleeping one. It is not an aggressive one yet either. The caseload so far is small and concentrated. Other enforcers exist. The Telecommunications Regulation and Control Agency inspects how operators handle subscriber data. The Superintendency of Banks runs the Credit Data Registry. The Ministry of Telecommunications is the lead body for the new cybersecurity law.

The maximum. The privacy law says data must not be kept longer than the purpose needs: 'Los datos personales seran conservados durante un tiempo no mayor al necesario para cumplir con la finalidad.' It also gives a right to deletion. You must act on that within fifteen days in four cases. The use of the data was unlawful. The purpose is spent. Consent was withdrawn. Or the keeping period has ended. The minimum. The Tax Code requires taxpayers to keep books and accounting records 'mientras la obligacion tributaria no este prescrita'. The tax authority can assess you for three years from the date of the return. That becomes six years where you filed no return, or an incomplete one. It has one year to re-check an assessment already made. Telecom operators must keep service-related information for the period set in the industry rules, not in the law itself. Health records are governed by the Ministry of Public Health's clinical-record rules. We could not open the manual to confirm the exact period, so it is listed as unconfirmed. When they clash. The privacy rule against keeping data too long gives way to a legal duty to keep it. Keeping data because a law requires it is a lawful reason in its own right. So the tax minimum beats the privacy maximum for the documents it covers. The safe pattern is simple. Keep the tax-relevant documents for the period the law sets. Delete everything else on the shorter privacy clock.

The privacy law says you must notify 'tan pronto sea posible, y a mas tardar en el termino de cinco (5) dias despues de que haya tenido constancia'. In Ecuador 'termino' means working days. So that is five working days, not five calendar days. The same rule sends the notification to the telecommunications regulator too, where a telecom provider is involved. A separate rule requires you to tell the affected individual without delay, and within three days of learning of the risk. So the customer clock is shorter than the regulator clock. A draft general rule on breach notification was published for comment in May 2026. It would move notifications onto the National Personal Data Protection System. It would sort incidents by severity automatically before a human review. And it would require telling the public through at least two mass-media channels. It is a draft with no legal effect. The Organic Law for the Strengthening of Cybersecurity was published in the Official Register on 22 May 2026. It applies to public bodies, digital service providers and private operators of critical digital infrastructure. It leaves response times, coordination protocols and reporting formats to later rules. It gives twelve months to set up the national incident response team. So its clock has not started yet.

1. You get three days to tell affected people, and five days to tell the regulator. Both are counted in working days. 2. The 2023 General Regulation requires you to register in the National Register of Personal Data Protection within ten days of starting to use the data. The 2026 transfers rule requires each international transfer to be registered at least ten days before it happens. You also file one combined annual report if you rely on a safe-country finding or on safeguards. So a routine engineering decision to move a workload to a new region can be unlawful, just for want of a filing. 3. The General Regulation makes a data protection delegate compulsory for any company with one hundred or more employees. It is also compulsory for smaller ones whose use of data is risky, regular, or involves special categories. A twelve-person Ecuadorian subsidiary of a global group can be caught by that second test. 4. The 2024 technical guide on registering a special attorney is blunt. Where a foreign company has not registered one, 'todas las personas naturales o juridicas que, segun las circunstancias, aparentaren actuar u obrar por cuenta de los sujetos regulados' answer for the use of the data. Local distributors and staff become the target. 5. Fines are a percentage of the previous financial year's turnover. That is 0.1% to 0.7% for minor breaches, and 0.7% to 1% for serious ones. 'Volumen de negocio' means revenue from sales and services in the last financial year, after value added tax and related direct taxes. Public officials are fined in multiples of the unified basic salary instead. That is one to ten for minor breaches, and ten to twenty for serious ones. The Superintendency published its calculation method on 16 July 2025. So the numbers are formulaic, not negotiable. 6. A bonus trap for anyone doing survey, drone or mapping work. Cartographic activity in Ecuador needs registration and authorisation from the Military Geographic Institute. That includes foreign companies. It comes from a 1978 cartography law that predates everything else here.

Dated items: - By 22 May 2027: the national computer security incident response team must be organised under the Organic Law for the Strengthening of Cybersecurity. The later rules setting response times, coordination protocols and reporting formats are due then too. Until that happens the law is in force, but its day-to-day duties are not. - Early 2027: the twelve-month transitional window in the 2026 transfers rule closes. Organisations that declared existing transfers and filed a plan are protected from penalties during that window. After it, they are not. - Undated: a draft general rule on personal data breach notification was published in May 2026. A draft general rule on biometric data was published in March 2026. Both are out for comment. Both would add duties if adopted. Neither is binding. - The Superintendency has also issued a rule on reviewing and evaluating the privacy law itself. That points at proposals to reform the law, but does not change the law by itself. Powers the regulator already holds, which could change things with no consultation: 1. The safe-country list. The Superintendency can declare a country safe enough, or decline to, by resolution alone. Today the list is empty, so everyone is on contractual safeguards. A single decision could reroute a whole market. 2. Refusing or revoking individual transfer permissions. The exceptional-case route is discretionary, and the regulator has already shown it will impose corrective measures. 3. Corrective measures short of a fine. The privacy law lets the regulator order you to change how you use data. In the football cases it ordered deletion of consent records and mass notification of individuals. That costs more commercially than the fines. 4. The cybersecurity regulator's power to set incident reporting deadlines by later rules, with no minimum fixed in the law.