EcuadorLOPDP, control, infracciones, sanciones y la Autoridad
LOPDP, arts. 61-77 (control, infracciones, sanciones y la Autoridad)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Superintendencia (Autoridad) de Protección de Datos Personales
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Personal Data Protection Authority to exercise continuous control over your processing, to open preliminary actions and an administrative procedure, and to impose corrective measures.
- Expect a data subject to be able to address a requirement to you directly under article 62, and the Authority to impose provisional or precautionary measures under article 74.
- Expect the sanctions in articles 71 and 72 for the minor and grave infractions articles 67 to 70 list, calculated on the business turnover article 73 defines.
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionNo
Penalty structure
For a private-law entity, or a public enterprise, found to have committed a grave infraction: a fine of between 0.7% and 1% of business turnover for the immediately preceding fiscal year. A public servant whose act or omission caused the infraction is instead fined 10 to 20 unified basic salaries (salarios básicos unificados).
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 1
What it makes you log
Logging duty
Articles 61 to 77 set the Authority's continuous control, the complaint procedure, corrective measures, infractions, sanctions and the Authority's functions. They create no log, register or record duty for a controller or processor. Article 76(4) lets the Authority carry out or delegate technical audits of processing and Article 76(1) gives it supervision and evaluation of what controllers do, which is a regulator's power rather than a record duty. The Authority's own statistical register of breaches (Article 76(14)) and the register of defaulting controllers (Article 66) are records the Authority keeps, not duties on the regulated party. The row cites no scope clause, so the territorial hook is empty.
- Kind
- None
- As of
What this law does
Article 61 gives the Personal Data Protection Authority continuous control, article 62 lets a data subject address it directly, articles 63 and 64 set the preliminary actions and the administrative procedure, and articles 65 and 66 the corrective measures and their application. Articles 67 to 70 list the minor and grave infractions of the controller and of the processor, articles 71 and 72 the sanctions for each, and article 73 defines the business turnover the sanctions regime is calculated on.
Article 74 provides for provisional or precautionary measures. Articles 75 to 77 establish the Personal Data Protection Authority and its functions, powers and head. The corrective-measures and sanctions regime, unlike the rest of the Act, did not begin to apply until two years after the Act's publication in the Official Registry. The law was published in Registro Oficial Suplemento 459 of and is recorded there as in force, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .