Ecuador Data Protection & Privacy Regulation

Lawful Processing & Special Data

A new biometric-data norm, identified in legal commentary as SPDP-SPD-2026-0039-R, is reported to tighten the conditions under which biometric data may lawfully be processed. In asymmetric or subordination relationships, such as between an employer and employee, the norm is reported to require that consent to biometric processing be genuinely free, and that, as a general rule, a reasonable non-biometric alternative be offered. This requirement responds to a structural concern common to biometric-consent regimes: where a data subject cannot realistically refuse without professional or economic consequence, consent alone cannot be relied upon as a lawful basis, and an alternative processing path becomes necessary to preserve the voluntariness the consent framework requires.

The same reported norm restricts secondary use of biometric data: data obtained for one purpose may not be repurposed for a different purpose unless the controller obtains fresh consent or a valid sensitive-data condition independently applies. Together, the free-consent-plus-alternative requirement and the purpose-limitation restriction on biometric data represent a tightening of Ecuador's special-category data regime beyond what a general consent-based model would otherwise require, placing biometric processing under conditions closer to those applied to other sensitive-data categories under the LOPDP framework.

Both elements are reported as in-force as at 9 September 2026. The underlying primary text of the resolution has not been directly retrieved, so these obligations are described here as reported by legal commentary rather than confirmed against the gazette text itself.

Outlook

Confirmation of the primary text of SPDP-SPD-2026-0039-R would allow a precise statement of the scope of the asymmetric-relationship test and the sensitive-data conditions available as an alternative to fresh consent for secondary biometric processing.

Controller/Processor Duties

The most notable controller/processor-facing development this cycle concerns not operators' own duties directly but the procedural framework under which the SPDP itself evaluates compliance. The SPDP's official LOPDP evaluation procedure applies an exceptional process for fiscal years 2024, 2025, 2026 and 2027, omitting the socialisation phase that would otherwise form part of a standard evaluation. This exceptional treatment is explicitly tied to the SPDP's own late operational start in September 2024, roughly three years after the LOPDP entered into force in 2021. The full standard evaluation procedure, including the socialisation phase, is not due to apply until fiscal year 2028 onward.

For controllers and processors operating in Ecuador, this means the compliance-evaluation environment through 2027 is itself transitional: the SPDP is applying a procedure calibrated to its own institutional catch-up rather than the steady-state procedure that will eventually govern evaluations from 2028. No other controller/processor-specific duty, such as a DPIA threshold or accountability-documentation requirement distinct from this procedural point, was independently re-verified this cycle.

Outlook

The exceptional evaluation procedure is scheduled to give way to the standard procedure from 2028. Controllers and processors should expect the evaluation environment to tighten as that transition approaches, and should watch for any SPDP guidance clarifying how the exceptional-period evaluations conducted between 2024 and 2027 will be treated once the standard procedure takes effect.

Controller/Processor Duties

Ecuador's standing large-scale-processing threshold continues to govern when a controller or processor must conduct a data protection impact assessment and designate a data protection officer. Resolución SPDP-SPD-2026-0005-R establishes a six-point quantitative threshold that, once met, qualifies processing as gran escala and triggers both obligations. This threshold predates the current reporting window but remains the operative in-force rule, and it is confirmed at a high degree of confidence against the primary resolution text itself.

Alongside this standing threshold, the SPDP is reported to have updated security-breach-management criteria among its four resolutions of 9 September 2026. The specific notification deadline and risk threshold introduced by this update have not been independently located; the headline fact of an update is attested only by secondary legal-press summaries rather than the primary resolution text, and the account here is accordingly hedged rather than assertive as to the detail of the new breach-management criteria.

Outlook

Retrieval of the primary text of the updated breach-management resolution would allow the specific notification deadline and risk-assessment criteria to be stated, closing the current gap between the confirmed headline update and the unconfirmed operational detail.

Algorithmic, Biometric & Surveillance Governance

The SPDP is understood to have issued Resolución SPDP-SPD-2026-0009-R as its first AI-specific rule, a notable development given Ecuador's data-protection framework had not previously addressed algorithmic governance as a distinct regulatory category. The resolution obliges entities that use AI systems processing personal data to adopt clear AI policies and to demonstrate documentation, controls and transparency over how their algorithms are supervised. This transparency obligation is reported through secondary legal commentary rather than confirmed directly against the primary resolution text, and the resolution's exact effective date has not been established this cycle.

The same resolution is further reported to require entities to identify the AI systems they have in use, determine whether those systems process personal or sensitive data, and build a preliminary risk matrix organised by system type and impact. This risk-assessment component carries a lower confidence than the transparency obligation itself, resting on the same secondary commentary without independent confirmation from the primary text. Taken together, these two strands represent Ecuador's first attempt to bring AI-specific processing within its existing data-protection perimeter, rather than leaving algorithmic processing to be governed solely by the LOPDP's general provisions.

Outlook

Confirmation of the resolution's primary text, its exact effective date, and the precise scope of the risk-matrix requirement would substantially sharpen this picture. Until then, the transparency and documentation obligations should be treated as probable rather than fully confirmed, and the risk-assessment requirement as uncertain.

Algorithmic, Biometric & Surveillance Governance

Ecuador's AI-governance norm, Resolución SPDP-SPD-2026-0009-R, has been reformed by Resolución SPDP-SPD-2026-0037-R, with the reform falling within the 9 September 2026 window of SPDP resolutions. The reformed norm applies to any organisation that develops, trains, implements, deploys or provides AI systems processing Ecuadorian personal data, and it empowers the SPDP to audit such AI systems and impose corrective or precautionary measures. This is confirmed against legal-commentary reporting on the reform and represents an increase in the scope of provider and encargado responsibility for AI systems operating on Ecuadorian personal data.

The same 9 September 2026 window is reported to have introduced a dedicated biometric-data norm, requiring genuinely free consent and a non-biometric alternative in asymmetric relationships, and restricting secondary reuse of biometric data without fresh consent or a valid sensitive-data condition. Read together, the AI-system audit power and the biometric-data consent and reuse restrictions represent a coordinated tightening of SPDP's algorithmic- and biometric-governance framework within a single reporting window, extending both the scope of what the regulator may audit and the conditions under which biometric data may lawfully be processed.

The primary Registro Oficial text of both the AI-reform resolution and the biometric-data norm has not been directly retrieved this cycle; the account above rests on independent legal-press and legal-commentary summaries, and the degree of confidence in the specific obligations is calibrated accordingly, assertive where the sourcing is a direct quotation of commentary describing the audit power, and qualified where the detail is paraphrased.

Outlook

Continued attention to SPDP's exercise of the newly reported AI-audit power, once primary-source confirmation is available, would clarify whether the reformed norm's corrective and precautionary measures are being applied in practice against AI systems processing Ecuadorian personal data.

Enforcement & Redress

The defining fact of Ecuador's enforcement record is structural rather than episodic: investigative reporting by Primicias found that zero sanctions had been imposed under the LOPDP as of publication, despite the law having been in force since 2021. This is attributed to the LOPDP's own statutory design, under which the SPDP must first impose corrective measures for serious infractions and may only proceed to sanction where those corrective measures are not complied with. The corrective-measures-first requirement functions as a structural brake on sanctioning activity, distinct from, and prior to, any question of regulator capacity or caseload.

Separately, the SPDP issued Resolución SPDP-SPD-2026-0038-R, with the underlying process initiated by a memorandum dated 3 September 2026. The substantive subject matter of this resolution has not been confirmed from the fragment of it retrieved this cycle, and it is recorded here as a dated development of unconfirmed scope rather than a described enforcement action.

Outlook

The central open question for Ecuador's enforcement trajectory is whether the SPDP has imposed any sanction since the Primicias zero-sanctions finding, which would mark the first substantive test of the corrective-measures-first design five years into the LOPDP's life. Equally relevant is clarification of what Resolución SPDP-SPD-2026-0038-R actually addresses, since its scope remains unconfirmed.

Enforcement & Redress

The SPDP sanctioned LIGAPRO on 20 January 2026 for failing to implement data protection by design and by default in its FAN ID application. This enforcement action is confirmed directly against SPDP's own press reporting, which states that the SPDP sanctions LIGAPRO for failing to implement data protection by design and by default. The specific monetary amount of the sanction has not been located, so the enforcement action is reported here as to its basis and target but not as to its quantum.

This action sits alongside, and is the most recent enforcement precedent ahead of, the four resolutions the SPDP is reported to have issued on 9 September 2026 updating its complaints-handling and security-breach-management criteria. Together, the LIGAPRO sanction and the September resolutions indicate continuing and active use of SPDP's enforcement and rule-making powers within the current reporting window, with privacy-by-design and by-default obligations now attested as an enforceable standard in practice rather than only as a textual requirement.

Outlook

Locating the monetary amount of the LIGAPRO sanction, and the primary text of the updated complaints-handling criteria among the September resolutions, would complete the picture of how SPDP is calibrating both the severity of its enforcement response and the procedural rights available to complainants under the revised framework.