LOPDP

Lawful basis and consent requirements

Consent is one of the lawful bases available under Ecuador’s LOPDP.

Where consent is used, it must be:

• Free
• Specific
• Informed
• Unequivocal

The LOPDP defines consent as a manifestation of free, specific, informed, and unequivocal will through which the data subject authorises the controller to process their personal data.

However, organisations should not assume that consent is required for every processing activity.

The LOPDP recognises multiple lawful bases for processing personal data. Organisations should therefore determine the appropriate legal basis for each processing purpose before implementing their consent strategy.

For websites, this distinction is particularly important when managing analytics, advertising, personalisation, and other tracking technologies.

Sensitive personal data

The LOPDP provides enhanced protection for special categories of personal data.

Organisations processing sensitive information should assess the applicable legal basis and additional requirements before processing begins.

Consent mechanisms should clearly identify relevant sensitive data processing where consent is required and should not bundle sensitive-data consent into unclear or overly broad permissions.

Data subject rights

The LOPDP provides individuals with rights concerning their personal data.

These include:

Organisations should maintain a documented process for receiving, authenticating, tracking, and responding to these requests.

Privacy notices and transparency

Organisations should provide individuals with clear and understandable information about how their personal data is processed.

A privacy notice should explain relevant information such as:

• Identity of the controller
• Categories of personal data collected
• Purposes of processing
• Applicable legal basis
• Recipients or categories of recipients
• International transfers, where applicable
• Data retention information
• Data subject rights
• How individuals can exercise their rights
• Contact information for privacy-related requests

Transparency should be maintained throughout the data lifecycle and not limited to the initial collection stage.

Data security

The LOPDP requires controllers and processors to implement appropriate security measures for protecting personal data.

The law specifically requires security measures to take into account factors such as the nature of the personal data, the processing context, risks, threats, and vulnerabilities.

Security measures can include:

• Technical safeguards
• Organisational controls
• Access management
• Encryption where appropriate
• Monitoring
• Data minimisation
• Incident response
• Business continuity measures
• Employee awareness and training

Organisations should periodically assess whether their safeguards remain appropriate as processing activities and risks change.

Data protection impact assessments

The Ecuadorian framework includes data protection impact assessments (DPIAs) for processing activities that may create significant risks to individuals.

A DPIA can help organisations identify:

• The nature and purpose of processing
• Potential risks to individuals
• Security and privacy controls
• Necessity and proportionality of processing
• Measures for reducing identified risks

Organisations carrying out high-risk processing should assess whether a DPIA is required before processing begins.

Data Protection Officer

The Ecuadorian framework establishes requirements concerning the appointment of a Data Protection Officer (DPO) for certain organisations and processing activities.

The DPO function can include responsibilities such as:

• Advising on data protection obligations
• Monitoring compliance
• Supporting DPIAs
• Cooperating with the supervisory authority
• Providing guidance on data subject rights
• Promoting privacy governance within the organisation

Organisations should assess whether their size, activities, data categories, or processing operations trigger a DPO requirement.

Data breach notification

The LOPDP framework establishes obligations relating to personal data security breaches.

Organisations should maintain procedures to:

1. 1Detect security incidents.
2. 2Assess whether personal data is affected.
3. 3Document the incident.
4. 4Determine applicable notification requirements.
5. 5Notify the competent authority where required.
6. 6Communicate with affected individuals where applicable.
7. 7Implement corrective measures.

A privacy programme should therefore connect security incident management with data protection compliance.

International data transfers

Ecuador’s framework regulates the transfer and communication of personal data, including international transfers.

The SPDP issued specific 2025 regulations addressing national and international transfers or communications of personal data. The rules require organisations to apply the relevant provisions of the LOPDP and its General Regulation when conducting international data transfers.

Organisations should assess:

• Where personal data is being transferred
• Who receives the data
• The purpose of the transfer
• The categories of data involved
• The destination country
• Applicable safeguards
• Contractual requirements
• The legal basis for the transfer

International data flows should be documented as part of the organisation’s broader data mapping programme.

Data retention and deletion

Personal data should not be retained indefinitely without an appropriate purpose.

Organisations should establish retention periods based on:

• Purpose of processing
• Applicable legal obligations
• Contractual requirements
• Security considerations
• Data subject rights
• Regulatory requirements

When personal data is no longer required, organisations should apply appropriate deletion, anonymisation, or other legally required measures.

Ecuador’s SPDP has also issued a specific regulation concerning the anonymisation, blocking, suspension, and elimination of personal data, further developing this aspect of the framework.

Cookies and online tracking

Cookies, pixels, advertising trackers, analytics tools, and other technologies can involve the processing of personal data.

Organisations operating websites in Ecuador should therefore identify:

• Cookies and trackers deployed
• Data collected by each technology
• Processing purposes
• Third-party recipients
• International transfers
• Applicable lawful bases
• Whether consent is required
• Whether trackers should be blocked before consent

Where consent is the applicable lawful basis, ConsentX can help organisations obtain valid consent before applicable tracking technologies are activated.