EcuadorLOPDP, categorías especiales de datos personales
LOPDP, arts. 25-32 (categorias especiales de datos personales)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.
- Treat the data of children and adolescents, health data and disability data as special categories alongside sensitive data.
- Do not process sensitive data at all unless the data subject has given explicit consent or one of the other grounds article 26 lists applies.
- Process health data only on the terms articles 30 to 32 set, and credit data only as articles 28 and 29 permit, respecting the credit data subject's own rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 25 to 32 define the special categories and set the grounds for processing them. Article 26 requires explicit consent that states the purposes clearly, which is a condition on processing rather than a duty to keep a record of the consent. Articles 28 and 29 on credit data and 30 to 32 on health data state no log, register or audit duty. The row cites no scope clause, so the territorial hook is empty.
- Kind
- None
- As of
What this law does
Article 25 makes sensitive data, the data of children and adolescents, health data and disability data special categories of personal data. Article 26 prohibits the processing of sensitive data unless the data subject gives explicit consent or one of the other enumerated grounds applies.
Article 27 governs the personal data of deceased persons, articles 28 and 29 credit data and the rights of credit data subjects, and articles 30 to 32 health data, its processing, and its processing by private and public bodies. Article 21 separately gives children and adolescents a heightened right not to be the object of a decision based solely or partly on automated processing.
The law was published in Registro Oficial Suplemento 459 of and is recorded there as in force, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app serves under-18s, handles health records, provides financial services, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .