Ecuador's Organic Law on Personal Data Protection (LOPDP) is a GDPR-style privacy law that applies to companies abroad when they offer goods or services to people in Ecuador or monitor their behavior. If you have Ecuadorian users, or an Ecuadorian vendor processes your data, you need a data inventory, recorded legal bases, encryption and access controls, a 15-day workflow for data subject requests and the ability to notify a breach to the regulator within five business days.
This article is technical and informational, not legal advice. Confirm your situation with qualified Ecuadorian counsel.
Where the LOPDP stands in 2026
The LOPDP is Ecuador's comprehensive personal data law, covering how organizations collect, use, store and share personal data. The confirmed milestones:
- Law: published in Registro Oficial No. 459 (Fifth Supplement) on May 26, 2021.
- Enforcement: the law granted a two-year adaptation period; corrective measures and fines have applied since May 2023.
- General Regulation: published in Registro Oficial No. 435 (Third Supplement) on November 13, 2023.
- Regulator: the Superintendencia de Protección de Datos Personales (SPDP) got its first head in 2024 and now issues resolutions, guidance and technical standards through its own online system (SISPDP).
- Recent SPDP rules: a fine-calculation regulation and a data protection officer regulation (both July 2025), and a technical standard on breach notification published September 24, 2026.
Ecuador also passed a cybersecurity law in May 2026 that amended several statutes, including the LOPDP, and created a separate incident-reporting regime for essential services, critical digital infrastructure and digital service providers.
LOPDP vs GDPR at a glance
If your privacy program is built for the GDPR, most of the work carries over. The differences that matter operationally are deadlines and fines:
| Topic | Ecuador LOPDP | EU GDPR |
|---|---|---|
| Extraterritorial reach | Yes, when offering goods or services to people in Ecuador or monitoring their behavior | Yes, similar test |
| Breach notice to regulator | Within five business days of becoming aware | Within 72 hours |
| Notice to individuals | Without delay, within three days when their rights are at risk | Without undue delay when high risk |
| Response to access, rectification, deletion, objection | 15 days | One month, extendable |
| Maximum fines (private sector) | 0.1% to 1% of prior-year turnover, by severity | Up to EUR 20 million or 4% of global turnover |
| DPO / DPIA | Required in defined cases; DPIA before high-risk processing | Required in defined cases; DPIA before high-risk processing |
If you only comply with US state privacy laws, expect more work: the LOPDP requires a legal basis for every processing activity, not just notice and opt-out.
From statute to system: obligations mapped to controls
| Obligation | Technical control | Evidence |
|---|---|---|
| Know what data you process | Data inventory by system, table and field, tagged by category (sensitive, minors, financial) | Up-to-date record of processing |
| Legal basis and consent | Immutable consent log: who, when, text version, channel, purpose; one-click withdrawal | Consent table with history |
| Data minimization | Forms and APIs that collect and return only what is needed | Schema and API contract reviews |
| Storage limitation | Retention rules per data type with automated deletion or anonymization | Purge jobs and their logs |
| Security (encryption, pseudonymization) | TLS in transit, KMS-managed encryption at rest, pseudonymized analytics | Key configuration and rotation |
| Confidentiality | Least privilege, MFA, RBAC, quarterly access reviews | Role matrix and review records |
| Accountability | Centralized, tamper-resistant logs of access to personal data | Queryable audit trail |
| Demonstrable security | Periodic penetration testing and vulnerability management | Reports and re-test results |
The law calls for state-of-the-art measures, names anonymization, pseudonymization and encryption explicitly, and allows organizations to rely on international standards. A SOC 2 or ISO 27001 program covers much of this if Ecuadorian data is in scope. Our cybersecurity services use this same matrix as the starting point for an LOPDP gap assessment.
Data subject rights inside your product
The LOPDP grants rights of access, rectification, deletion, objection, portability, restriction and not to be subject to decisions based solely on automated processing. Access, rectification, deletion and objection requests must be answered within 15 days, free of charge. In engineering terms:
- An in-app or web request channel that timestamps requests and verifies identity.
- Lookup by data subject across every inventoried system: primary database, CRM, analytics, backups and processors.
- Machine-readable export (JSON or CSV) for access and portability.
- Real deletion or anonymization in production, propagated to processors, with documented legal-hold exceptions.
- A request queue with due dates so the 15-day clock is never missed.
If you already run a DSAR workflow for the GDPR or CCPA, add Ecuador as a jurisdiction with a shorter deadline.
Breach notification: five business days
Under Article 43 of the LOPDP, the controller must notify the regulator as soon as possible and no later than five business days after becoming aware of a breach, unless it is unlikely to create a risk to individuals. Processors must notify the controller within two days. Article 46 adds notice to affected individuals without delay, within three days when their rights are at risk, with limited exceptions. The SPDP September 2026 technical standard requires notification through its SISPDP system and treats failure to notify as a serious infringement.
Your incident response plan should add Ecuador to the jurisdiction matrix alongside the GDPR 72-hour rule and US state breach laws, with pre-approved templates. Our incident response plan guide walks through it.
Data protection officer, vendors and cross-border transfers
The LOPDP requires a data protection officer in the public sector, where processing requires permanent and systematic monitoring, and for large-scale processing of sensitive data. A July 2025 SPDP regulation lists private activities that must appoint one, including financial institutions, insurers, education and organizations processing minors' data, with registration through the regulator.
For vendor relationships, the law distinguishes the controller from the processor. If an Ecuadorian nearshore team processes your users' data, your contract should work as a data processing agreement: purpose limitation, security measures, confidentiality, two-day breach notice and return or deletion at the end. Data leaving Ecuador is an international transfer, allowed to countries the regulator deems adequate or with appropriate safeguards, and otherwise subject to authorization. When we work as a nearshore team, we prefer that production data stays in the client's cloud and that engineers work with anonymized datasets.
Impact assessments and privacy by design
Article 42 requires a data protection impact assessment before high-risk processing: profiling with automated decisions that have legal effects, large-scale processing of sensitive data, or large-scale systematic monitoring of public areas. Credit scoring, telehealth and video analytics features should be assessed before development. Common gaps to look for:
- Pre-ticked consent boxes, or no record of which text version the user accepted.
- Production databases copied unmasked into test environments.
- A "delete account" button that only deactivates the user.
- Logs storing national ID numbers, passwords or tokens in plain text.
- No list of which vendors hold copies of the data.
Frequently asked questions
Does Ecuador's LOPDP apply to US companies?
It can. The LOPDP applies to controllers and processors outside Ecuador when their processing relates to offering goods or services to people residing in Ecuador or to monitoring their behavior. A US SaaS company actively serving Ecuadorian users, or an app marketed in Ecuador, should assume it is in scope and confirm the analysis with Ecuadorian counsel.
How fast must a data breach be reported in Ecuador?
The controller must notify the Superintendencia de Protección de Datos Personales as soon as possible and no later than five business days after becoming aware of the breach, through the SISPDP online system. Processors must alert the controller within two days. Affected individuals must be notified without delay, within three days, when the breach puts their rights at risk.
How does the LOPDP compare to the GDPR?
The structure is very similar: legal bases, data subject rights, DPO and DPIA requirements, processor contracts and transfer rules. The key differences are shorter deadlines, with 15 days to answer most rights requests and five business days for breach notice, and fines capped at 1% of prior-year turnover instead of the GDPR maximum of 4% or EUR 20 million.
What fines can the LOPDP impose?
For private companies, minor infringements carry fines of 0.1% to 0.7% of prior-year turnover and serious infringements 0.7% to 1%. The regulator weighs intent, repetition, harm and recidivism, following a fine-calculation regulation issued in July 2025. Public officials face fines measured in Ecuadorian minimum monthly wages instead of turnover.
Is it safe to use an Ecuadorian nearshore vendor with personal data?
Yes, if the contract and controls are right. Ecuador has a GDPR-style law with an active regulator, so a vendor processing your data is itself bound by security and breach-notice duties. Sign a data processing agreement, keep production data in your own cloud where possible, grant least-privilege access with MFA and require anonymized datasets for development and testing.
Conclusion
The LOPDP now has an active regulator, turnover-based fines and short deadlines. For engineering teams the work is familiar: inventory, consent records, encryption, access control, logging, retention and response workflows, tuned to Ecuador's shorter clocks. A penetration test provides evidence that those controls actually work. If you need a technical gap assessment against the LOPDP, explore our cybersecurity services or book a free consultation; we work alongside your legal counsel.