Ecuador’s Organic Law on Personal Data Protection (Ley Orgánica de Protección de Datos Personales) establishes the rights of individuals over their personal information and the obligations of every company that collects, stores or processes it. The law applies to local companies as well as foreign companies that process the data of people in Ecuador, and non-compliance may result in significant fines. Companies processing personal data that are not established in Ecuador must also appoint a special representative in the country.
Our team helps companies understand their obligations and implement practical compliance programs adapted to their business.
Compliance Programs
- Mapping of the personal data the company collects, where it is stored and who has access to it.
- Privacy policies, notices and consent forms for websites, apps, employees and customers.
- Data processing agreements with suppliers, service providers and related companies.
- Internal policies, security measures and training for personnel.
- Advice on the appointment of a Data Protection Officer when required.
International Data Transfers
Many of our clients are multinational companies that share information between their headquarters and their Ecuadorian subsidiaries or distributors. We advise on the requirements and safeguards established by the law and the Superintendence’s regulations to transfer personal data outside of Ecuador lawfully.
Data Subject Requests
We assist companies in responding to requests from individuals exercising their rights of access, rectification, deletion, opposition and portability within the deadlines established by law.
Security Incidents
When a data breach occurs, time is critical. We guide companies through the assessment of the incident, the notifications required before the data protection authority and affected individuals, and the measures needed to limit its consequences.
Proceedings and Disputes
We represent clients in proceedings before the Superintendence of Personal Data Protection (Superintendencia de Protección de Datos Personales) and in disputes related to the processing of personal data.
Data protection is closely related to our technology law and intellectual property practices, allowing us to offer comprehensive advice on databases, software, e-commerce and digital marketing.
