EcuadorLOPDP, transferencia internacional de datos personales
LOPDP, arts. 55-60 (transferencia internacional de datos personales)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- on_request
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Before transferring personal data outside Ecuador, obtain an Authority adequacy resolution, put appropriate safeguards in place, or obtain the Authority's case-by-case authorization.
- Where you rely on binding corporate rules, make them meet what article 58 requires before transferring on them.
- Where you rely on one of the exceptional cases in article 60 instead, use one the article lists.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 59 requires information about an international transfer to be registered beforehand in the national register of personal data protection by the controller or processor (Spanish: "deberá ser registradas previamente en el Registro Nacional"), and requires the controller to guarantee compliance "documentadamente" (in documented form) to obtain the Authority's authorization. The register carries no event-log fields, so the contents list is empty. Binding corporate rules, an optional route under Article 58, must include data protection audits whose results go to the data protection delegate and the group board and are available to the Authority; that audit expectation applies only to a controller that relies on that route. The row cites no scope clause, so the territorial hook is empty.
- Kind
- Explicit
- As of
- Provision
- Article 59, second paragraph (international transfers registered beforehand in the national register), with Article 59, first paragraph (documented guarantee of compliance)
- Trigger
- personal_data_processing
What this law does
Articles 55 and 56 govern the international transfer or communication of personal data, article 57 transfer on adequate safeguards, article 58 binding corporate rules, article 59 the Authority's authorisation for every other transfer, and article 60 the exceptional cases in which a transfer or communication may proceed without one.
A transfer therefore rests on an Authority adequacy resolution, on safeguards meeting the standard the law states, or on the Authority's prior authorisation case by case. The law was published in Registro Oficial Suplemento 459 of and is recorded there as in force, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .