EcuadorLOPDP, comprehensive personal-data protection regime
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Obligation class
- Consent, Security, DPIA, Governance
- Audit expectation
- on_request
- Who audits it
- Registered or designated auditor
What it requires
- Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.NIST Privacy FrameworkCT.PO-P1
- Secure personal data with the technical and organisational measures articles 37 to 41 require, determined from a risk, threat and vulnerability analysis, and build data protection into the design of your processing and make it the default.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.PO-P2
- Carry out an impact assessment of the processing where article 42 requires one.NIST Privacy FrameworkID.RA-P4
- Designate a data protection delegate where the law requires one, and let the delegate carry out the functions article 49 sets.NIST Privacy FrameworkGV.PO-P3
- Register with the national register of personal data protection as article 51 requires.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 51 requires the controller to report to the Personal Data Protection Authority, and keep updated, a register entry that names the database or processing, its purpose, the nature of the data, the recipients, the security tools and the retention time (Spanish: "reportar y mantener actualizada la información ante la Autoridad"). Article 47(2) adds that the controller must apply tools that let it guarantee and demonstrate that processing follows the Act. None of the register contents is an event-log field, so the contents list is empty. The public right to consult the national register (Article 22) and the Authority's own statistical register of breaches (Article 76(14)) sit in sections this row does not cite. Article 3(1), which applies the Act to processing carried out anywhere in the national territory, and Article 3(4), which turns on a contract or international law, are left out of the territorial hook because they turn on where processing happens or on another instrument, not on one of the hook values.
- Kind
- Explicit
- As of
- Provision
- Article 51 (the controller reports to the Authority and keeps current the national register entry for its processing: identification, purposes, data nature, recipients, security measures and retention time), with Article 47(2) (tools to guarantee and demonstrate compliance)
- Trigger
- personal_data_processing
What this law does
Article 2 applies the law to the processing of personal data in any medium, automated or not, by any public or private controller or processor, with narrow exclusions for purely personal or household use and for the personal data of deceased persons, and article 3 sets its territorial reach. Article 7 makes processing legitimate only on one of the grounds it lists, article 8 governs consent and article 9 legitimate interest. Article 10 carries the principles.
Articles 33 to 36 govern the transfer or communication of personal data to another controller, access by a processor and access by third parties, and the exceptions to consent for those. Article 37 requires the controller or processor to secure personal data, article 39 requires data protection by design and by default, article 40 a risk, threat and vulnerability analysis, article 41 the determination of the applicable security measures and article 42 an impact assessment.
Article 47 lists the obligations of the controller and processor, articles 48 to 50 the designation, functions and special position of the data protection delegate, article 51 the national register, and articles 52 to 54 self-regulation, codes of conduct and certification entities. The law was published in Registro Oficial Suplemento 459 of and is recorded there as in force, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .