EcuadorSPDP Norma General guaranteeing personal-data protection in the use of AI systems
In force since .
A data subject rights rule binding public and private bodies.
- Enforcement body
- Superintendencia de Protección de Datos Personales
- Obligation class
- DPIA, Disclosure, Data subject rights, Governance
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- Guarantee the data subject's rights under the LOPDP, and access to the mechanisms for exercising them, where an AI system processes the data subject's personal data; a processor owes this only where it has access to, visibility of, or effective control over that data.NIST Privacy FrameworkCT.PO-P3
- Inform the data subject clearly, specifically, and transparently about personal-data processing carried out through an AI system, including its purposes.NIST Privacy FrameworkCM.AW-P1
- Before developing an AI system that will process personal data, carry out a risk-management process and, where applicable, an impact assessment.NIST Privacy FrameworkID.RA-P4
- Maintain a record of processing activities and audit the AI system's operation in proportion to its level of risk.NIST Privacy FrameworkID.IM-P4NIST Privacy FrameworkGV.MT-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 5.4 requires controllers and processors to include processing carried out through AI systems in the record of processing activities (registro de actividades de tratamiento, RAT), and Article 7.1 requires the RAT to include the AI system's automated decisions that have legal effects or affect the data subject's rights, and to be made available to the Superintendency. The articles name no field list, so the contents list is empty. The audit keys already on the row (Article 5.5 and Article 7.3, audits of the AI system in proportion to risk) are unchanged. Article 1 reaches AI systems that process personal data of Ecuadorian data subjects regardless of where the system or provider is located; the text says "titulares ecuatorianos" (Ecuadorian data subjects), and the nearest hook value is data subject residence.
- Kind
- Explicit
- As of
- Provision
- Article 5.4 and Article 7.1 (processing through AI systems goes into the record of processing activities, the RAT, including automated decisions with legal effects, which is available to the Superintendency)
- Trigger
- personal_data_processing
- automated_decisions
What this law does
This resolution binds any controller that develops, trains, implements, deploys, or provides an artificial-intelligence system that processes personal data, and, as reformed, a processor only where it has access to, visibility of, or effective control over the data, whenever that system falls within the LOPDP's material and territorial scope.
Article 4 as first issued guaranteed, at all times, the data subject's right not to be the object of a decision based solely or partly on automated valuations, together with the right to information and the right to object. The reform replaced Article 4 with a guarantee of the rights the LOPDP recognizes and of access to the mechanisms for exercising them. Article 5 requires the controller or processor to inform the data subject clearly and specifically about the AI-based processing.
Article 6 requires a prior risk-management process, and an impact assessment where one is called for, before developing an AI system that will process personal data. The resolution states that it takes effect upon its publication in the Registro Oficial. It was published in Registro Oficial Año I No. 240 of .
Resolution SPDP-SPD-2026-0037-R, published in Registro Oficial Año II No. 373 of , made the resolution's obligations enforceable against a processor only for the operations or phases of processing where it has access to, visibility of, or effective control over the personal data.
When LexLint raises it
When your app profile says your app trains models.
Back to the example · Lint your app
Page updated .