EcuadorLOPDP, notificación de vulneración de seguridad
LOPDP, arts. 43 y 46 (notificacion de vulneracion de seguridad)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the Authority and the telecommunications regulator of a personal-data security breach as soon as possible and no later than five days after becoming aware of it.
- Notify the affected data subject within 3 days of learning of the risk, where the breach carries a risk to their fundamental rights and individual freedoms.
- As a processor, notify the controller of any personal-data security breach as soon as possible and within 2 days of learning of it.
- Give the reasons for the delay where your notification to the Authority is later than the five days article 43 allows.
- Where notifying every affected data subject would take a disproportionate effort, make a public communication of the breach instead.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 43 requires the controller to notify a personal-data security breach to the Authority and the telecommunications regulator within five days, with the reasons for any delay, and the processor to notify the controller within two days. Article 46 requires notice to the data subject within three days, with an exception where effective protective measures "se pueda demostrar" (can be shown) and the Authority qualifies it. Both articles are notification duties only: neither says to document or keep a register of breaches, so the row states no record duty. The row cites no scope clause, so the territorial hook is empty.
- Kind
- None
- As of
What this law does
Article 43 requires the controller to notify a personal-data security breach to the Personal Data Protection Authority and to the telecommunications regulator as soon as possible and no later than five days after becoming aware of it, unless the breach is unlikely to pose a risk to the rights and freedoms of natural persons, and to give the reasons for any delay where the notification is later than that.
The same article requires the processor to notify the controller of any personal-data security breach as soon as possible and no later than two days from the date it learns of it.
Article 46 requires the controller to notify the data subject without delay where the breach carries a risk to their fundamental rights and individual freedoms, within three days from the date it learned of the risk, and excuses that notice only where the controller had applied demonstrably effective protection measures to the affected data, where it has taken measures ensuring the risk will not occur, or where notice would take a disproportionate effort, in which case it must make a public communication instead.
The law was published in Registro Oficial Suplemento 459 of and is recorded there as in force, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .