Processes personal data, in Ecuador

LOPDP, arts. 12-19, 22-24 (derechos del titular) · Read the law's page

• Answer a data subject's request for information, access, rectification, updating, erasure, objection, portability or suspension of the processing on the terms articles 12 to 19 set.

LOPDP, arts. 25-32 (categorias especiales de datos personales) · Read the law's page

• Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.
• Treat the data of children and adolescents, health data and disability data as special categories alongside sensitive data.
• Do not process sensitive data at all unless the data subject has given explicit consent or one of the other grounds article 26 lists applies.
• Process health data only on the terms articles 30 to 32 set, and credit data only as articles 28 and 29 permit, respecting the credit data subject's own rights.

LOPDP, arts. 43 y 46 (notificacion de vulneracion de seguridad) · Read the law's page

• Notify the Authority and the telecommunications regulator of a personal-data security breach as soon as possible and no later than five days after becoming aware of it.
• Notify the affected data subject within 3 days of learning of the risk, where the breach carries a risk to their fundamental rights and individual freedoms.
• As a processor, notify the controller of any personal-data security breach as soon as possible and within 2 days of learning of it.
• Give the reasons for the delay where your notification to the Authority is later than the five days article 43 allows.
• Where notifying every affected data subject would take a disproportionate effort, make a public communication of the breach instead.

LOPDP, arts. 55-60 (transferencia internacional de datos personales) · Read the law's page

• Before transferring personal data outside Ecuador, obtain an Authority adequacy resolution, put appropriate safeguards in place, or obtain the Authority's case-by-case authorization.
• Where you rely on binding corporate rules, make them meet what article 58 requires before transferring on them.
• Where you rely on one of the exceptional cases in article 60 instead, use one the article lists.

LOPDP, arts. 61-77 (control, infracciones, sanciones y la Autoridad) · Read the law's page

• Expect the Personal Data Protection Authority to exercise continuous control over your processing, to open preliminary actions and an administrative procedure, and to impose corrective measures.
• Expect a data subject to be able to address a requirement to you directly under article 62, and the Authority to impose provisional or precautionary measures under article 74.
• Expect the sanctions in articles 71 and 72 for the minor and grave infractions articles 67 to 70 list, calculated on the business turnover article 73 defines.

Ley Orgánica de Protección de Datos Personales (LOPDP), arts. 1-11 y 33-54 (ámbito, principios, seguridad y obligaciones del responsable) · Read the law's page

• Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.
• Secure personal data with the technical and organisational measures articles 37 to 41 require, determined from a risk, threat and vulnerability analysis, and build data protection into the design of your processing and make it the default.
• Carry out an impact assessment of the processing where article 42 requires one.
• Designate a data protection delegate where the law requires one, and let the delegate carry out the functions article 49 sets.
• Register with the national register of personal data protection as article 51 requires.