Runs an essential service, in Ecuador

LOPDP, arts. 43 y 46 (notificacion de vulneracion de seguridad) · Read the law's page

• Notify the Authority and the telecommunications regulator of a personal-data security breach as soon as possible and no later than five days after becoming aware of it.
• Notify the affected data subject within 3 days of learning of the risk, where the breach carries a risk to their fundamental rights and individual freedoms.
• As a processor, notify the controller of any personal-data security breach as soon as possible and within 2 days of learning of it.
• Give the reasons for the delay where your notification to the Authority is later than the five days article 43 allows.
• Where notifying every affected data subject would take a disproportionate effort, make a public communication of the breach instead.