Ecuador

Article 43 requires the controller to notify a personal-data security breach to the Personal Data Protection Authority and to the telecommunications regulator as soon as possible and no later than five days after becoming aware of it, unless the breach is unlikely to pose a risk to the rights and freedoms of natural persons, and to give the reasons for any delay where the notification is later than that.

The same article requires the processor to notify the controller of any personal-data security breach as soon as possible and no later than two days from the date it learns of it.

Article 46 requires the controller to notify the data subject without delay where the breach carries a risk to their fundamental rights and individual freedoms, within three days from the date it learned of the risk, and excuses that notice only where the controller had applied demonstrably effective protection measures to the affected data, where it has taken measures ensuring the risk will not occur, or where notice would take a disproportionate effort, in which case it must make a public communication instead.

The law was published in Registro Oficial Suplemento 459 of 26 May 2021 and is recorded there as in force, which is the day these provisions began to bind.

Article 2 applies the law to the processing of personal data in any medium, automated or not, by any public or private controller or processor, with narrow exclusions for purely personal or household use and for the personal data of deceased persons, and article 3 sets its territorial reach. Article 7 makes processing legitimate only on one of the grounds it lists, article 8 governs consent and article 9 legitimate interest. Article 10 carries the principles.

Articles 33 to 36 govern the transfer or communication of personal data to another controller, access by a processor and access by third parties, and the exceptions to consent for those. Article 37 requires the controller or processor to secure personal data, article 39 requires data protection by design and by default, article 40 a risk, threat and vulnerability analysis, article 41 the determination of the applicable security measures and article 42 an impact assessment.

Article 47 lists the obligations of the controller and processor, articles 48 to 50 the designation, functions and special position of the data protection delegate, article 51 the national register, and articles 52 to 54 self-regulation, codes of conduct and certification entities. The law was published in Registro Oficial Suplemento 459 of 26 May 2021 and is recorded there as in force, which is the day these provisions began to bind.

Articles 55 and 56 govern the international transfer or communication of personal data, article 57 transfer on adequate safeguards, article 58 binding corporate rules, article 59 the Authority's authorisation for every other transfer, and article 60 the exceptional cases in which a transfer or communication may proceed without one.

A transfer therefore rests on an Authority adequacy resolution, on safeguards meeting the standard the law states, or on the Authority's prior authorisation case by case. The law was published in Registro Oficial Suplemento 459 of 26 May 2021 and is recorded there as in force, which is the day these provisions began to bind.

Article 20 gives every data subject the right not to be subject to a decision based solely or partly on automated assessments, including profiling, that produces legal effects on them or that harms their fundamental rights and freedoms.

To exercise it, the data subject may ask the controller for a reasoned explanation of the decision, submit observations, ask for the automated program's assessment criteria, ask what data types were used and their source, and challenge the decision before the controller or processor.

The right does not apply where the decision is necessary to enter into or perform a contract, or where the data subject was told before the first communication with them that a decision would be based solely on automated assessments.

Article 21 extends the same right to children and adolescents in a heightened form, barring the processing of their sensitive data or their data for an automated decision unless the data subject's legal representative expressly authorized it or the processing safeguards an essential public interest that meets international human-rights standards of legality, proportionality and necessity.

Article 12 gives the data subject a right to information, article 13 a right of access, article 14 a right of rectification and updating, article 15 a right of erasure, article 16 a right to object, article 17 a right to portability and article 19 a right to suspension of the processing, with article 18 setting the exceptions to rectification, updating and erasure.

Article 22 gives a right of consultation, article 23 a right to digital education, and article 24 fixes how the rights are exercised. The law was published in Registro Oficial Suplemento 459 of 26 May 2021 and is recorded there as in force, which is the day these provisions began to bind.

This resolution binds any controller that develops, trains, implements, deploys, or provides an artificial-intelligence system that processes personal data, and, as reformed, a processor only where it has access to, visibility of, or effective control over the data, whenever that system falls within the LOPDP's material and territorial scope.

Article 4 as first issued guaranteed, at all times, the data subject's right not to be the object of a decision based solely or partly on automated valuations, together with the right to information and the right to object. The reform replaced Article 4 with a guarantee of the rights the LOPDP recognizes and of access to the mechanisms for exercising them. Article 5 requires the controller or processor to inform the data subject clearly and specifically about the AI-based processing.

Article 6 requires a prior risk-management process, and an impact assessment where one is called for, before developing an AI system that will process personal data. The resolution states that it takes effect upon its publication in the Registro Oficial. It was published in Registro Oficial Año I No. 240 of 10 March 2026.

Resolution SPDP-SPD-2026-0037-R, published in Registro Oficial Año II No. 373 of 21 September 2026, made the resolution's obligations enforceable against a processor only for the operations or phases of processing where it has access to, visibility of, or effective control over the personal data.

Article 61 gives the Personal Data Protection Authority continuous control, article 62 lets a data subject address it directly, articles 63 and 64 set the preliminary actions and the administrative procedure, and articles 65 and 66 the corrective measures and their application. Articles 67 to 70 list the minor and grave infractions of the controller and of the processor, articles 71 and 72 the sanctions for each, and article 73 defines the business turnover the sanctions regime is calculated on.

Article 74 provides for provisional or precautionary measures. Articles 75 to 77 establish the Personal Data Protection Authority and its functions, powers and head. The corrective-measures and sanctions regime, unlike the rest of the Act, did not begin to apply until two years after the Act's publication in the Official Registry. The law was published in Registro Oficial Suplemento 459 of 26 May 2021 and is recorded there as in force, which is the day these provisions began to bind.

Article 25 makes sensitive data, the data of children and adolescents, health data and disability data special categories of personal data. Article 26 prohibits the processing of sensitive data unless the data subject gives explicit consent or one of the other enumerated grounds applies.

Article 27 governs the personal data of deceased persons, articles 28 and 29 credit data and the rights of credit data subjects, and articles 30 to 32 health data, its processing, and its processing by private and public bodies. Article 21 separately gives children and adolescents a heightened right not to be the object of a decision based solely or partly on automated processing.

The law was published in Registro Oficial Suplemento 459 of 26 May 2021 and is recorded there as in force, which is the day these provisions began to bind.

Article 234 punishes, with three to five years' imprisonment, a person who, without authorization, accesses all or part of a computer, telematic, or telecommunications system, or remains inside it against the will of the person with the legitimate right, in order to unlawfully exploit the access obtained, modify a web portal, divert or redirect data or voice traffic, or offer the services those systems provide to third parties without paying the legitimate service providers.

Because the offence's trigger is unauthorized access exploited for one of those listed purposes, reading a public, unauthenticated page without defeating an access control and without one of the listed purposes falls outside a plain reading of the provision.

Article 232 punishes, with three to five years' imprisonment, a person who destroys, damages, deletes, deteriorates, alters, suspends, obstructs, causes malfunction or unwanted behaviour of, or suppresses computer data, e-mail messages, or an information, telematic, or telecommunications processing system or its logical components.

The same penalty reaches designing, developing, programming, acquiring, sending, introducing, executing, selling, or distributing malicious software or programs meant to cause those effects, and destroying or altering, without authorization, the technological infrastructure needed to transmit, receive, or process information. The penalty rises to five to seven years where the target is infrastructure for a public service or linked to public safety.

Article 230(1) punishes, with three to five years' imprisonment, a person who, without prior judicial order and for their own benefit or a third party's, intercepts, listens to, diverts, records, or observes, in any form, a computer datum at its origin, destination, or inside a computer system, or a signal or data transmission, with the aim of obtaining registered or available information.

Reading a public, unauthenticated page does not fit a plain reading of an offence built around a judicial-order requirement and an interception of a transmission.

Article 229 punishes, with one to three years' imprisonment, a person who, for their own benefit or a third party's, reveals information registered or contained in files, archives, databases, or similar media, through or directed at an electronic, computer, telematic, or telecommunications system, deliberately and intentionally breaching the secrecy, privacy, and intimacy of persons.

The penalty rises to three to five years where a public servant, or a bank or savings-and-credit-cooperative employee carrying out financial intermediation, or a contractor commits the same act.

Article 211 states that using or exploiting a protected work or performance in the cases the next article lists is not a violation of patrimonial rights, provided it does not conflict with the work's normal exploitation and does not cause unjustified prejudice to the rights holder's legitimate interests, tested against a four-factor standard (the purpose and nature of the use, the nature of the work, the amount used relative to the whole, and the effect on the work's market value).

Article 212 then lists the acts that do not require authorization, including brief quotation for analysis, comment, or criticism with attribution, and, at item 9, an enumerated set of purposes for which a library, archive, or museum may reproduce a single copy of a work already in its collection, the eighth of which is text mining.

The exception is therefore not a general-purpose text-and-data-mining allowance: it is available only to a library, archive, or museum reproducing a work already in its own collection, not to a commercial or research entity scraping or mining text from the open web at large.

Article 140 protects a compilation of data or other material, in any form, as such, only where the originality of the selection or arrangement of its contents constitutes an intellectual creation; that protection does not extend to the underlying data or information compiled, and does not affect any copyright or related right subsisting in the works or performances the compilation contains. The article also states that the protection it recognizes for databases does not apply to software.

Ecuador therefore has no sui generis database right of the European kind, protecting a producer's investment in obtaining, verifying, or presenting the contents regardless of originality; only a compilation-copyright model tied to originality of selection or arrangement.

Article 24(15) of the Law requires a provider to adopt measures to guarantee the security of the networks. Article 76 of the Law requires a provider, whether it uses its own network or a third party network, to adopt adequate technical and management measures to preserve the security of its services and the invulnerability of the network. Article 76 of the Law requires those measures to guarantee a level of security suited to the existing risk.

Under article 85 of the Law the telecommunications regulator issues instructions that bind providers to adopt measures on the integrity and security of networks and services. Article 85 of the Law lets the regulator require a provider to supply the information needed to assess the security and integrity of its services and networks. Article 85 of the Law lets the regulator require a provider to undergo a security audit at the provider cost.

Article 117(b)(16) of the Law makes any other breach of the duties in the Law by a holder of an enabling title a first-class infraction. Article 121(1) of the Law sets the fine for a first-class infraction at between 0.001% and 0.03% of the reference amount. Article 122 of the Law derives the reference amount from the total income of the infringer on its last income tax return, in relation to the service or enabling title concerned.

The Ley Orgánica de Telecomunicaciones was published in Registro Oficial Supplement 439 of 18 February 2015. The Law entered into force on its publication in the Registro Oficial.

Article 79 of the Law requires a provider to inform its subscribers, clients and users of a particular risk of a security violation of the public network or the telecommunications service and of the measures to adopt. Article 76 of the Law requires the provider to inform its subscribers, clients or users of a particular risk of violation of network security.

Where the measures to reduce a security risk are not under its control, article 76 of the Law requires the provider to tell its subscribers the possible solutions. Article 79 of the Law separately requires the provider to notify an individual subscriber or user immediately of a violation of that person's data. Article 117(b)(16) of the Law makes any other breach of the duties in the Law by a holder of an enabling title a first-class infraction.

Article 121(1) of the Law sets the fine for a first-class infraction at between 0.001% and 0.03% of the reference amount. The Ley Orgánica de Telecomunicaciones was published in Registro Oficial Supplement 439 of 18 February 2015. The Law entered into force on its publication in the Registro Oficial.

Article 212(1) permits, without the rights holder's authorization, including brief fragments of an already-disclosed written, sound, audiovisual, artistic, photographic, or figurative work in one's own work, provided the inclusion is by way of quotation or for analysis, comment, or critical judgment, with teaching or research purposes, to the extent justified by that purpose, and provided the source and author's name are indicated and the use is not a disguised exploitation of the work.

The same provision states that periodic compilations made in the form of press reviews or a press digest are considered quotations for this purpose. That treatment is not capped at a headline-length or short-extract threshold in the article's text, and article 211 additionally requires that the use not conflict with the work's normal exploitation and not cause unjustified prejudice to the rights holder, tested against a four-factor standard.