A support assistant that reads a customer's history, an agent that screens résumés, a chatbot that serves patients: all of them process personal data. In Ecuador, that processing is governed by the Organic Law on Personal Data Protection (LOPDP), enforceable with penalties since May 2023 and supervised by the Superintendencia de Protección de Datos Personales. Using artificial intelligence does not exempt you from complying; on the contrary, it introduces new risks the law already contemplates.
This guide explains, without unnecessary legal language, what the LOPDP requires when you bring language models into your processes, which mistakes are most common and how to design an AI system that complies from the start. It does not replace advice from a specialized lawyer, but it will let you arrive at that conversation with the right questions.
Why AI changes the data protection picture
- Data travels to third parties. Every query to Claude, GPT or Gemini sends text to a provider's servers, usually outside Ecuador. That is an international data transfer and a processing engagement.
- Data gets concentrated. A RAG system gathers in one place documents that used to live scattered. One improper access exposes everything at once.
- Automated decisions appear. If an agent approves or rejects a credit application, a candidate or a claim, the law grants specific rights to the affected person.
- Models can leak information. A poorly designed assistant can reveal one customer's data to another, or an employee can extract information they should not have access to.
What the LOPDP requires and how it translates to an AI project
Legal basis for processing
All processing needs a legitimate basis: consent, performance of a contract, legal obligation or legitimate interest, among others. If you are going to use customer data for a new purpose (for example, training a recommendation model or feeding an assistant), you must verify that the purpose is covered by the original legal basis, or inform people and, where applicable, obtain consent. Using data "because we already have it" is not a legal basis.
Information and transparency
People must know that their data is processed with AI systems, for what purpose, who the processors are (including model providers) and whether there are international transfers. This is reflected in your privacy policy and, for chatbots, in a clear notice that the person is interacting with an automated system.
Minimization
You must only process the data necessary for the purpose. In practice: do not send the model the customer's full file if the task only requires their current order. Anonymize or pseudonymize before sending whenever possible. It is a legal obligation and it also reduces token costs and risk.
Processors and international transfers
The model provider acts as a data processor. You need a contract (providers offer it as a Data Processing Agreement or data processing addendum) establishing that it only processes data on your instructions, does not use it for its own purposes, applies security measures and deletes it when finished. For the international transfer, the LOPDP allows countries with an adequate level of protection, contractual clauses, or the informed consent of the data subject. Document which mechanism you use.
Automated decisions
The law recognizes the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect the person, with exceptions. If an AI agent decides on credit, hiring, insurance or claims, you must guarantee meaningful human intervention, inform the person and let them challenge the decision and obtain an explanation. We treat this as a design principle in our guide on AI agents: high-impact actions always with human approval.
Security and breach notification
You must apply appropriate technical and organizational measures and notify security breaches to the authority and, where applicable, to the data subjects. In an AI system this includes encryption, per-user access control in document retrieval, query logging and protection against prompt injection. Our guide on application security covers the foundation.
Data subject rights
Access, rectification, erasure, objection and portability. If a customer asks you to delete their data, you must be able to remove it from your vector database, from conversation logs and from any copy the AI system uses as well. Design that capability from the start; adding it later is expensive.
Impact assessment
For high-risk processing (sensitive data such as health, profiling, automated decisions, large volume) the LOPDP requires a prior impact assessment. An AI project that processes health data or makes decisions about people almost always falls into this category. The assessment documents risks, measures and justification, and it is your best defense in an inspection.
Data protection officer
Mandatory for certain entities and for large-scale or sensitive-data processing. If you deploy AI over personal data at scale, check whether you must appoint one.
Common mistakes when using AI with personal data
- Using consumer accounts (the free or personal chat) to process customer data. Those accounts often allow data to be used for training and offer no processor contract. Always use API or business plans.
- Sending more data than necessary to the model out of convenience.
- Not filtering by permissions in RAG and trusting the model "not to mention" what it should not. Filtering belongs in retrieval, not in the prompt.
- Storing conversations indefinitely with no retention policy or deletion mechanism.
- Omitting the notice that the person is talking to an automated system.
- Automating decisions about people without human review or a way to appeal.
- Not documenting the legal basis, the processors, the transfers and the security measures. Before the authority, what is not documented does not exist.
Checklist for an LOPDP-compliant AI project
- Purpose of processing defined and legal basis identified.
- Inventory of which personal data enters the system and why each item is necessary.
- Anonymization or pseudonymization before sending to the model whenever possible.
- Data processing agreement signed with each AI provider.
- International transfer mechanism documented.
- Privacy policy updated for AI use and a notice in the chatbot.
- Per-user access control in document retrieval.
- Human intervention in decisions with significant effects on people.
- Retention policy and the ability to delete data from every copy, including the vector database.
- Logging of queries and actions for auditing.
- Protection against prompt injection and periodic security testing.
- Breach response and notification plan.
- Impact assessment if the processing is high risk.
Choosing the provider and the architecture
The technical decision has direct legal consequences. The business APIs from Anthropic, OpenAI and Google offer data processing agreements, do not train on your data and allow limited or zero retention. If you need data to stay within a region, the options are Amazon Bedrock, Google Vertex AI or Microsoft Azure with a selected region, or an open-source model hosted on your own infrastructure. We compare the alternatives in how to choose an LLM: Claude, GPT or open source.
For the architecture, the principles are the same as in any secure application: the model receives only what is necessary, access decisions are made by your system and not by the model, every action is logged and data has a defined lifecycle.
Frequently asked questions
Can I use ChatGPT or Claude with my customers' data?
Yes, as long as you use API or business plans with a data processing agreement, have a legal basis for the purpose, inform data subjects, minimize the data sent and document the international transfer. With free or personal accounts, no.
Do I need consent to use AI in customer service?
Not necessarily. If AI is used to deliver the service the customer contracted, the legal basis is usually performance of the contract. You do have to clearly inform that processing includes AI systems and that the person is interacting with one. For new purposes (profiling, marketing) consent may be required.
Can an AI chatbot make decisions about customers?
It can prepare or recommend decisions. If the decision has legal or significant effects (granting credit, rejecting a claim, hiring), the LOPDP requires meaningful human intervention, information to the data subject and the right to challenge.
What penalties does the LOPDP provide?
Fines that, depending on the severity of the infringement, can reach up to 1% of the previous year's revenue for serious infringements, plus the obligation to correct the processing and the associated reputational damage.
Do open-source models hosted in Ecuador solve the problem?
They eliminate the international transfer and the external processor, which simplifies compliance, but the remaining obligations (legal basis, minimization, security, rights, automated decisions) still apply in full.
Conclusion
The LOPDP does not prohibit using artificial intelligence with personal data; it requires doing so with a clear purpose, a legal basis, transparency, minimization, contracts with providers, security and human control over what affects people. These are also the practices that make an AI system trustworthy and sustainable. Building them in from the design stage costs a fraction of fixing them later, or of a penalty.
Want to deploy AI in your company in compliance with the LOPDP from day one? At MisterProSoft we design AI systems with data minimization, access control, traceability and verified security. Schedule a free consultation and learn about our artificial intelligence and cybersecurity services.
