🇪🇨Organic Law on Personal Data Protection
Organic Law on Personal Data Protection
The LOPDP applies to automated and non-automated processing subject to its material and territorial rules. Executive Decree 904 develops its operational requirements.
Core duties
The Law establishes lawful bases, consent standards, transparency, data-subject rights, special-category and children’s-data rules, controller and processor accountability, security and breach duties, impact assessments, privacy by design/default, DPO requirements and international-transfer mechanisms.
The regulation adds an Ecuador representative requirement for covered foreign organisations, request registers, specific breach-notice content, impact-assessment criteria, records of processing for threshold and risk cases, processor-contract clauses, deletion or return at termination, and detailed transfer mechanisms.