16 OCT 2025 · Executive Order

Superintendency for the Protection of Personal Data's Regulation for the Application of Fine Calculation Methodology (Resolution No. SPDP-SPD-2025-0022-R)

On 16 October 2025, the Regulation for the application of the methodology for calculating fines in the administrative sanctions regime enters into force. The Regulation applies to public officials and private entities, including public companies acting as controllers, processors, or third parties under the Organic Law on Personal Data Protection (LOPDP). The Regulation mandates a standard methodology to calculate fines for minor and serious offences, using proportionality criteria such as int...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

26 MAY 2021 · Law / Act

Additional rights for personal data including their extraterritorial application

On 26 May 2021, the “Law on the Protection of Personal Data” of Ecuador entered into force. The law gives Ecuadorian residents the right to access, rectify, oppose and eliminate records of personal data, in addition to the right to data portability. Moreover, the law requires adequacy decisions to pursue cross-border personal data transfers and applies to extraterritorial applications to data handlers who supply services to Ecuadorian residents from abroad. In case of violation, the Data Prot...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

26 MAY 2021 · Law / Act

Data protection authority governance in Law on the Protection of Personal Data

On 26 May 2021, the “Law on the Protection of Personal Data” of Ecuador entered into force. The law created the Data Protection Superintendence as an autonomous data protection authority. The Authority has the power to investigate data protection rights' violations and commit fines between 0,1% and 1% of data controllers' last annual revenue.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified