--- title: "Ecuador Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ecuador/ source_html: /jurisdictions/ecuador/index.html description: "Ecuador data protection and privacy regulation: 10 categories, 83 claims, updated 2026-10-18. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: e39a187952a0b8b7a8eecfc0833edc44f4ceae6f8b62e982f0f87ec4cdd0580b generator: "fe-fleet/md-twin@1.0" --- # Ecuador Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/ecuador/), [World Payments](https://payments.gi/jurisdictions/ecuador/), artificial-intelligence Last updated 2026-10-18 · 10 categories · 83 claims · 68 sources in the cumulative register Download report (PDF) Expand all Ecuador's data-protection regulator is moving rapidly from foundational statute to detailed operational rulemaking. Data collected 2026-10-18 · Data published 2026-10-18 AI-assembled from cited sources Not fully checked this cycle: Data Subject Rights, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (4 open gaps). Evidence re-verified: 2026-10-18 · Position last changed: 2026-10-18 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ECUADOR)[Build Report](/reports/?j=ECUADOR)[Compare](/compare/?j=ECUADOR) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority European Data Protection Supervisor (EDPS) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 83 Claims 71 Tier-1 sources Traffic-light mix 7 green 3 amber (sums to 10 rendered categories; click to filter) No red categories; 8 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,179 Full executive summary 171 ###### Latest update · 18 October 2026 #### Lead Signal Ecuador's data-protection regime this cycle shows a pattern of formal institutional deepening paired with a structural enforcement gap. The Superintendencia de Protección de Datos Personales (SPDP), created by the LOPDP as an independent, de-concentrated control authority with sanctioning power, only began operating roughly three years after the law's 2021 entry into force. Investigative reporting from Primicias found that, despite the LOPDP having been in force since 2021, zero sanctions had been imposed as of publication, a position attributed to the law's structural design: for serious infractions, the SPDP must first impose corrective measures and may only sanction if those measures are not complied with. This is the defining tension of Ecuador's regime as it stands: formally robust instruments, an operating regulator, and a recent run of secondary rulemaking, set against an enforcement record so far limited to zero completed sanctions. #### Other Developments A 2026 institutional rulemaking agenda. The SPDP's Plan Regulatorio Institucional 2026, set by Resolución SPDP-SPD-2025-0050-R of 30 December 2025, laid out the agenda for issuing secondary rules through 2026 implementing the LOPDP. Several of the developments below trace to that agenda. Territorial scope restated. SPDP Resolución SPDP-SPD-2026-0009-R restates the LOPDP's extraterritorial test: the law applies when a controller or processor not established in Ecuador processes the data of Ecuador-resident data subjects in connection with offering goods or services, or monitoring behaviour, occurring in Ecuador. This is a restatement of an existing test rather than a new one. A phased evaluation procedure for the SPDP itself. The SPDP's official LOPDP evaluation procedure applies an exceptional process, omitting the socialisation phase, for fiscal years 2024 through 2027, in recognition of the SPDP's own late start in September 2024. The full standard procedure is not due to apply until 2028. Cross-border transfer mechanisms formalised. SPDP Resolución SPDP-SPD-2026-0004, dated 28 January 2026, regulates national and international data transfers. It permits adequacy-based transfers and, absent an adequacy finding, permits standard contractual clauses, binding corporate rules, codes of conduct or certification, specifically adopting RIPD model clauses for controller-to-controller transfers. A first AI-specific rule. SPDP Resolución SPDP-SPD-2026-0009-R is understood to be the SPDP's first AI-specific resolution, obliging entities that use AI systems processing personal data to adopt clear AI policies and demonstrate documentation, controls and transparency over how their algorithms are supervised. It is further understood to require identifying AI systems in use, determining whether they process personal or sensitive data, and building a preliminary risk matrix by system type and impact, though this latter requirement rests on secondary commentary rather than the primary resolution text, and its exact effective date has not been confirmed. A further September 2026 resolution of unconfirmed scope. SPDP Resolución SPDP-SPD-2026-0038-R was issued via a process initiated by memorandum dated 3 September 2026; its substantive subject matter has not been confirmed from the fragment retrieved this cycle. #### Cross-Monitor Connections The AI-specific transparency and risk-assessment obligations introduced by Resolución SPDP-SPD-2026-0009-R intersect with the artificial-intelligence monitor's coverage of algorithmic governance requirements in Latin America; readers tracking AI-specific regulatory obligations separately from general data-protection duties should cross-reference that monitor for the broader regional picture. No other cross-monitor connection was identified from this cycle's findings. #### Outlook Two open questions define the near-term outlook. First, whether SPDP has imposed any sanction since the Primicias zero-sanctions finding, which would mark the first substantive test of the corrective-measures-first enforcement design. Second, the substantive content and effective date of Resolución SPDP-SPD-2026-0038-R, issued in September 2026 but not yet confirmed in scope. Confirmation of either would materially sharpen the enforcement and algorithmic-governance picture for Ecuador. 1 earlier update not shown here. ###### Standing brief · as of 14 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Ecuador's data-protection regulator is moving rapidly from foundational statute to detailed operational rulemaking. The Superintendencia de Protección de Datos Personales, constituted under the Ley Orgánica de Protección de Datos Personales (published in the Official Gazette Supplement 459 on 26 May 2021) as an independent regulator with sanctioning powers under LOPDP Article 76, issued a resolution in February 2026 introducing a quantitative 'Método Técnico de Gran Escala' to determine when personal-data processing counts as large-scale, triggering heightened statutory obligations. This is a confirmed, in-force change that gives controllers and processors, for the first time, an objective threshold test rather than a qualitative judgment call for one of the LOPDP's most consequential compliance triggers. The same period saw the SPDP move on two further fronts simultaneously: an AI-focused General Norm, Resolución SPDP-SPD-2026-0009-R of 12 February 2026, now requires organisations to clearly inform data subjects when their personal data is processed via AI systems and to conduct risk or impact assessments before deploying AI systems that process personal data. Taken together with the large-scale-processing threshold issued the same month, this signals a regulator moving on multiple compliance fronts at once rather than sequencing its rulemaking programme one topic at a time. #### Other Developments A draft biometric-data norm is circulating for consultation. The SPDP has circulated a draft General Norm on biometric-data processing that would further specify obligations for facial, fingerprint, and other unique-identifier data. This remains at draft stage and is not yet finalised, so controllers processing biometric data should treat the draft as a strong signal of where obligations are heading rather than as a current binding requirement. A breach-notification procedure is also pending formalisation. The SPDP circulated a draft resolution, referred to in its own filing as PR_vulneraciones, in May 2026, proposing to formalise breach-notification procedure and timelines for controllers and processors. Like the biometric norm, this is a horizon item rather than an in-force obligation as of this cycle, and its finalisation is expected within the coming two quarters based on the consultation stage it currently occupies. The SPDP's enforcement posture rests on a confirmed sanctioning power that the institution is still operationally maturing. SPDP is constituted as a control body with sanctioning power under LOPDP Article 76, a confirmed and in-force authority. At the same time, the SPDP's own organisational statute was still being formalised through further SPDP resolutions as of mid-2025, indicating that institutional capacity-building has been running in parallel with, rather than fully ahead of, the substantive rulemaking programme described above. #### Cross-Monitor Connections The AI-transparency and AI-risk-assessment obligations introduced by Resolución SPDP-SPD-2026-0009-R sit adjacent to the artificial-intelligence monitor's own coverage of algorithmic governance; readers tracking Ecuador's broader AI-regulatory posture should consult artificial-intelligence's Ecuador coverage for that dimension rather than expecting this monitor to analyse AI governance beyond its data-protection-specific transparency and risk-assessment angle. No financial-integrity, world-payments, or advennt cross-references were identified as directly relevant to this cycle's data-protection developments. #### Outlook Two items sit on a defined near-term horizon: the SPDP's draft breach-notification resolution and its draft biometric-data norm are both expected to reach finalisation around the fourth quarter of 2026, based on their current consultation stage. Their finalisation would convert two of this cycle's most consequential draft instruments into binding obligations, meaningfully expanding the controller/processor compliance surface beyond what is already in force through the large-scale-processing threshold and the AI-transparency norm. Read full brief · 1179 words Standing brief, as of 14 September 2026. #### Regulatory Status Ecuador's data-protection framework, anchored in the Ley Orgánica de Protección de Datos Personales (26 May 2021) and enforced by the independent Superintendencia de Protección de Datos Personales under LOPDP Article 76 sanctioning power, tightened substantially this cycle. A February 2026 SPDP resolution introduced a quantitative large-scale-processing threshold, the 'Método Técnico de Gran Escala'. The same month, Resolución SPDP-SPD-2026-0009-R introduced AI-specific transparency and pre-deployment risk-assessment obligations. Two further instruments remain at draft stage: a biometric-data General Norm and a breach-notification procedure (PR_vulneraciones), both expected to finalise around Q4 2026. The SPDP's own institutional organisational statute was still being formalised as of mid-2025, suggesting the regulator's operational capacity is maturing in parallel with its rapidly expanding substantive rulebook. #### Outlook Finalisation of the draft biometric-data and breach-notification norms, both expected around Q4 2026, represents the clearest near-term change to Ecuador's data-protection compliance surface. Organisations processing biometric data or lacking a formalised breach-response timeline should treat the current drafts as directional guidance ahead of that finalisation. Read full brief · 171 words Key regulatory facts for Ecuador Regulatory Dimension Ecuador Standing Position Jurisdiction Ecuador (EC) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 83 sourced findings) Regulator & Framework Comprehensive, actively enforced, single-instrument regime with a fully operational independent supervisor; only source of amber risk is the pending Digital Omnibus reform tracked in... Lawful Processing & Special Data Substantively aligned with GDPR; anonymisation/pseudonymisation boundary is an active area of guidance development, not a gap. Data Subject Rights Rights framework is comprehensive and actively supervised; some rights may be restricted under Art 25 internal-rules mechanism for specified public-interest grounds (investigations, security), which is a lawful... Controller/Processor Duties Fully codified and actively supervised (breach-notification web-portal, DPIA lists, DPO dismissal-consent rules updated January 2026); no material gaps identified. Primary Instruments Cited EDPS, EDPS, Publications Office of the EU, Publications Office of the EU, Meythaler Zambrano Abogados Last Confirmed / Updated 2026-10-18 (68 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Ecuador: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, actively enforced, single-instrument regime with a fully operational independent supervisor; only source of amber risk is the pending Digital Omnibus reform tracked in enforcement_and_redress.recent_developments_180d. Primary framework Regulation (EU) 2018/1725 (EUDPR) Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Green Comprehensive, actively enforced, single-instrument regime with a fully operational independent supervisor; only source of amber risk is the pending Digital Omnibus reform tracked in enforcement_and_redress.recent_developments_180d. #### Sub-modules (5) #### Regulator And AuthorityGreen The EDPS is the independent supervisory authority responsible for monitoring and enforcing EUDPR compliance across ~80 EU institutions, bodies, offices and agencies; Wojciech Wiewiórowski holds the post. Claims (4): - The European Data Protection Supervisor (EDPS) is the independent supervisory authority responsible for monitoring the processing of personal data by EU institutions and bodies, advising on policies/legislation affecting privacy, and cooperating with other supervisory authorities. - Superintendencia de Protección de Datos Personales (SPDP) — LOPDP art. 76 establishes the SPDP as the control and oversight body guaranteeing citizens' personal-data-protection rights. - Superintendencia de Protección de Datos Personales (SPDP) — LOPDP created the SPDP as an independent, de-concentrated control authority with sanctioning power, but the authority only began operating in 2024, roughly three years after the law's 2021 entry into force. - Superintendencia de Protección de Datos Personales (SPDP) — SPDP is Ecuador's dedicated, independent data-protection regulator with sanctioning powers under LOPDP Art. 76 #### Act And InstrumentsGreen Core instrument is Regulation (EU) 2018/1725, supplemented by Commission Decision (EU) 2020/969 (DPO/restrictions implementing rules) and the EDPS Rules of Procedure. Claims (4): - Regulation (EU) 2018/1725 lays down the data protection obligations for the EU institutions and bodies when they process personal data and repeals Regulation (EC) 45/2001, adopting a principle-based approach in line with the GDPR. - SPDP's 2026 Institutional Regulatory Plan (Resolución SPDP-SPD-2025-0050-R, 2025-12-30) scheduled a personal-data-portability general rule for October 2026. - SPDP Plan Regulatorio Institucional 2026 — Resolución SPDP-SPD-2025-0050-R (30 Dec 2025) set the agenda for issuing secondary rules through 2026 implementing the LOPDP. - Ley Orgánica de Protección de Datos Personales (LOPDP) — Official Gazette Supplement 459, 26 May 2021, implemented via a General Regulation and staged SPDP secondary rulemaking #### Material ScopeGreen EUDPR governs processing of personal data by Union institutions and bodies, including administrative processing by Europol/EPPO for staff matters; operational law-enforcement data of Europol/EPPO is carved out to their own founding legal acts, and a specific EUDPR chapter aligned with the Law Enforcement Directive applies to EU bodies processing operational data (e.g. Eurojust). Claims (1): - The processing of operational personal data by Europol and the European Public Prosecutor's Office is excluded from the scope of the EUDPR and instead governed by specific provisions in their founding legal acts, though their administrative processing of personal data (e.g. staff management) is subject to the Regulation. #### Territorial ScopeAmber EUDPR has no GDPR-style extraterritorial reach over non-EU private controllers; it applies to Union institutions and bodies as controllers regardless of where their processing physically occurs. This is a structurally different scope concept than GDPR Art 3, and should not be conflated with it. Claims (1): - SPDP Resolución SPDP-SPD-2026-0009-R — Restates the LOPDP's extraterritorial test: applies when a non-Ecuador-established controller/processor processes data of Ecuador-resident data subjects in connection with offering goods/services or monitoring behaviour occurring in Ecuador. #### Regulator Registration And FilingGreen Each EUI must designate a DPO who is registered with the EDPS after designation; EUIs must also maintain a Record of Processing Activities (ROPA) under Art 31, made publicly accessible via a central register where feasible. Claims (1): - After designation, the data protection officer of a Union institution or body shall be registered with the European Data Protection Supervisor by the institution or body which designated him or her. JID=EC covers the data-protection regime applicable to the EU institutions, bodies, offices and agencies (EUIs) themselves — i.e. the European Commission, Parliament, Council, agencies, EU IT-systems bodies, etc. — as controllers, NOT the GDPR regime applicable to private/public-sector controllers inside EU Member States (that is the domain of the 27 MS JIDs). The operative instrument is Regulation (EU) 2018/1725 (the 'EUDPR'), which replaced Regulation (EC) 45/2001 and mirrors the GDPR's principle-based architecture but is a distinct, self-contained legal instrument with its own supervisory authority, the European Data Protection Supervisor (EDPS). Periodic update · new data 2026-10-18 #### Regulator & Framework Ecuador's data-protection regime is anchored in the LOPDP (Ley Orgánica de Protección de Datos Personales), which created the Superintendencia de Protección de Datos Personales (SPDP) as an independent, de-concentrated control authority with sanctioning power. The SPDP did not begin operating until roughly three years after the LOPDP's 2021 entry into force, a lag between statutory creation and operational capacity that frames much of the regime's subsequent development. Once operational, the SPDP set out a structured rulemaking agenda: its Plan Regulatorio Institucional 2026, adopted via Resolución SPDP-SPD-2025-0050-R on 30 December 2025, laid out the schedule for issuing secondary rules through 2026 to implement the LOPDP. Among the resolutions issued under that agenda, SPDP Resolución SPDP-SPD-2026-0009-R restates the LOPDP's extraterritorial scope: the law reaches a controller or processor not established in Ecuador where it processes the personal data of Ecuador-resident data subjects in connection with offering goods or services, or monitoring behaviour, occurring within Ecuador. This is a restatement of the existing statutory test rather than an expansion of it, and the exact effective date of the resolution restating it has not been confirmed from the fragment retrieved this cycle. #### Outlook Further secondary rules are expected to follow under the SPDP's 2026 institutional regulatory plan. What would sharpen this picture is confirmation of the resolution's precise effective date and whether additional rulemaking addresses gaps in modules not independently re-verified this cycle. 1 earlier distinct update(s) Periodic update · new data 2026-10-05 #### Regulator & Framework The SPDP is understood to have issued four resolutions on 9 September 2026, updating the AI-governance norm, introducing a biometric-data norm, and revising criteria for complaints handling and security-breach management. This account rests on two independent legal-press summaries; the primary Registro Oficial text for these four resolutions has not been directly retrieved, and the specific contents are therefore stated at a qualified level of confidence rather than asserted outright. The existence of four resolutions issued on the same date, touching AI, biometrics, complaints and breach management together, points to a coordinated secondary-norm update rather than four unconnected measures, consistent with SPDP's pattern of building out implementing detail under the LOPDP framework through sequential resolutions rather than primary legislation. #### Outlook Retrieval of the primary gazette text for the four 9 September 2026 resolutions would allow the specific notification deadlines, complaints-handling timelines and risk thresholds referenced in secondary commentary to be stated with greater precision. Sources and claims (11) - [EDPS](https://www.edps.europa.eu/press-publications/press-news/press-releases/2025/edps-reprimands-frontex-non-compliance-regulation-eu-20191896_en) — The European Data Protection Supervisor (EDPS) is the independent supervisory authority responsible for monitoring the processing of personal data by EU institutions and bodies, advising on policies/legislation affecting privacy, and cooperating with other supervisory authorities. - [EDPS](https://www.edps.europa.eu/data-protection/our-work/subjects/regulation-20181725_en) — Regulation (EU) 2018/1725 lays down the data protection obligations for the EU institutions and bodies when they process personal data and repeals Regulation (EC) 45/2001, adopting a principle-based approach in line with the GDPR. - [Publications Office of the EU](https://eur-lex.europa.eu/EN/legal-content/summary/protection-of-individuals-with-regard-to-the-processing-of-personal-data-by-eu-institutions-bodies-offices-and-agencies.html) — The processing of operational personal data by Europol and the European Public Prosecutor's Office is excluded from the scope of the EUDPR and instead governed by specific provisions in their founding legal acts, though their administrative processing of personal data (e.g. staff management) is subject to the Regulation. - [Publications Office of the EU](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R1725) — After designation, the data protection officer of a Union institution or body shall be registered with the European Data Protection Supervisor by the institution or body which designated him or her. - [Meythaler Zambrano Abogados](https://www.meythalerzambranoabogados.com/post/norma-ia-proteccion-datos-ecuador-spdp-2026) — Superintendencia de Protección de Datos Personales (SPDP) — LOPDP art. 76 establishes the SPDP as the control and oversight body guaranteeing citizens' personal-data-protection rights. - [Lexis Ecuador](https://www.lexis.com.ec/noticias/registro-oficial-del-dia-la-superintendencia-de-proteccion-de-datos-personales-regula-el-tratamiento-de-informacion-a-gran-escala-en-ecuador) — SPDP's 2026 Institutional Regulatory Plan (Resolución SPDP-SPD-2025-0050-R, 2025-12-30) scheduled a personal-data-portability general rule for October 2026. - [NMS Abogados](https://nmslaw.com.ec/blog/2026/01/04/spdp-plan-regulatorio-institucional-2026-ecuador/) — SPDP Plan Regulatorio Institucional 2026 — Resolución SPDP-SPD-2025-0050-R (30 Dec 2025) set the agenda for issuing secondary rules through 2026 implementing the LOPDP. - [SPDP (via Fielweb)](https://www.fielweb.com/App_Themes/InformacionInteres/Resoluci_n_N_SPDP_SPD_2026_0009_R_1771459633.pdf) — SPDP Resolución SPDP-SPD-2026-0009-R — Restates the LOPDP's extraterritorial test: applies when a non-Ecuador-established controller/processor processes data of Ecuador-resident data subjects in connection with offering goods/services or monitoring behaviour occurring in Ecuador. - [https://www.primicias.ec/politica/cero-sanciones-ecuador-ley-proteccion-datos-personales-blandengue-104527/](https://www.primicias.ec/politica/cero-sanciones-ecuador-ley-proteccion-datos-personales-blandengue-104527/) — Superintendencia de Protección de Datos Personales (SPDP) — LOPDP created the SPDP as an independent, de-concentrated control authority with sanctioning power, but the authority only began operating in 2024, roughly three years after the law's 2021 entry into force. - [Superintendencia de Protección de Datos Personales (SPDP)](https://spdp.gob.ec/wp-content/uploads/2026/05/PR_vulneraciones.pdf) — Superintendencia de Protección de Datos Personales (SPDP) — SPDP is Ecuador's dedicated, independent data-protection regulator with sanctioning powers under LOPDP Art. 76 - [Orizontel](https://orizontel.ec/guia-lopdp-ecuador/) — Ley Orgánica de Protección de Datos Personales (LOPDP) — Official Gazette Supplement 459, 26 May 2021, implemented via a General Regulation and staged SPDP secondary rulemaking ### Ecuador: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Substantively aligned with GDPR; anonymisation/pseudonymisation boundary is an active area of guidance development, not a gap. Primary framework Regulation (EU) 2018/1725, Chapter II Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Green Substantively aligned with GDPR; anonymisation/pseudonymisation boundary is an active area of guidance development, not a gap. Periodic update · new data 2026-10-05 #### Lawful Processing & Special Data A new biometric-data norm, identified in legal commentary as SPDP-SPD-2026-0039-R, is reported to tighten the conditions under which biometric data may lawfully be processed. In asymmetric or subordination relationships, such as between an employer and employee, the norm is reported to require that consent to biometric processing be genuinely free, and that, as a general rule, a reasonable non-biometric alternative be offered. This requirement responds to a structural concern common to biometric-consent regimes: where a data subject cannot realistically refuse without professional or economic consequence, consent alone cannot be relied upon as a lawful basis, and an alternative processing path becomes necessary to preserve the voluntariness the consent framework requires. The same reported norm restricts secondary use of biometric data: data obtained for one purpose may not be repurposed for a different purpose unless the controller obtains fresh consent or a valid sensitive-data condition independently applies. Together, the free-consent-plus-alternative requirement and the purpose-limitation restriction on biometric data represent a tightening of Ecuador's special-category data regime beyond what a general consent-based model would otherwise require, placing biometric processing under conditions closer to those applied to other sensitive-data categories under the LOPDP framework. Both elements are reported as in-force as at 9 September 2026. The underlying primary text of the resolution has not been directly retrieved, so these obligations are described here as reported by legal commentary rather than confirmed against the gazette text itself. #### Outlook Confirmation of the primary text of SPDP-SPD-2026-0039-R would allow a precise statement of the scope of the asymmetric-relationship test and the sensitive-data conditions available as an alternative to fresh consent for secondary biometric processing. D2 · Lawful Processing — Full Module Record 4 sub-modules · 52 words · 7 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ecuador: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights framework is comprehensive and actively supervised; some rights may be restricted under Art 25 internal-rules mechanism for specified public-interest grounds (investigations, security), which is a lawful derogation, not a gap. Primary framework Regulation (EU) 2018/1725, Arts 14-25 Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Green Rights framework is comprehensive and actively supervised; some rights may be restricted under Art 25 internal-rules mechanism for specified public-interest grounds (investigations, security), which is a lawful derogation, not a gap. #### Sub-modules (5) #### Access RightGreen Art 17 grants the right of access, exercisable without unnecessary constraints, free of charge; the EDPS ran a Coordinated Enforcement Action reviewing EUI right-of-access practice in 2024. Claims (1): - The right of access under EUDPR allows a data subject to obtain confirmation that data concerning him or her are processed, the purposes of processing, and the logic involved in automated decisions, exercisable without unnecessary constraints, at any time, free of charge. #### Rectification And ErasureGreen Art 18 grants rectification of inaccurate data; Art 19 grants erasure ('right to be forgotten') on enumerated grounds; the EDPS ran a Coordinated Enforcement Action on the right to erasure in 2025. Claims (2): - The data subject has the right to obtain from the controller rectification of inaccurate personal data without undue delay, including completion of incomplete data by supplementary statement. - The right to erasure is enshrined in Article 19 of the EUDPR for EUIs, with similarities to Article 17 GDPR for EU/EEA countries; the EDPS conducted a fourth Coordinated Enforcement Action fact-finding exercise on EUI compliance with the right to erasure in 2025. #### Restriction And ObjectionGreen Art 20 grants restriction of processing; Art 23 grants the right to object on grounds relating to the data subject's particular situation; both may be restricted under the Art 25 internal-rules mechanism. Claims (1): - The EDPS may order the rectification or erasure of personal data or restriction of processing pursuant to Articles 18, 19 and 20 of the EUDPR, and notify such actions to recipients to whom the data have been disclosed. #### Data PortabilityGreen Art 22 grants the right to receive personal data in a structured, machine-readable format and to transmit it to another controller. Claims (2): - Under Article 22, the data subject has the right to receive personal data concerning him or her in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance. - SPDP's October-2025 'Protección de Datos desde el Diseño y por Defecto' guide treats data portability as a right controllers must design systems to support. #### Deadlines And Response WindowsGreen Controllers must respond to data-subject requests without undue delay and in any event within one month of receipt, extendable by two further months where necessary, with reasons communicated to the data subject. Claims (1): - The data controller must respond to a data subject's request for access to their personal data without undue delay and in any event within one month from receipt, which may be extended by two further months where necessary. EUDPR Arts 14-24 grant EUI data subjects rights of information, access, rectification, erasure, restriction, portability and objection, with a general one-month response deadline (extendable by two months). The EDPS actively supervises these rights via Coordinated Enforcement Framework participation (2024 access review, 2025 erasure review, 2026 transparency review). Sources and claims (7) - [EDPS](https://www.edps.europa.eu/system/files/2024-02/EDPS2024-04-CEA-right-of-access_EN.pdf) — The right of access under EUDPR allows a data subject to obtain confirmation that data concerning him or her are processed, the purposes of processing, and the logic involved in automated decisions, exercisable without unnecessary constraints, at any time, free of charge. - [Publications Office of the EU](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R1725) — The data subject has the right to obtain from the controller rectification of inaccurate personal data without undue delay, including completion of incomplete data by supplementary statement. - [EDPS](https://www.edps.europa.eu/press-publications/press-news/press-releases/2025/edps-participates-fourth-coordinated-enforcement-action-focus-right-erasure-personal-data_en) — The right to erasure is enshrined in Article 19 of the EUDPR for EUIs, with similarities to Article 17 GDPR for EU/EEA countries; the EDPS conducted a fourth Coordinated Enforcement Action fact-finding exercise on EUI compliance with the right to erasure in 2025. - [EDPS](https://www.edps.europa.eu/sites/default/files/publication/19-09-27_powers_of_edps_under_regulation_eu_2018-1725_en.pdf) — The EDPS may order the rectification or erasure of personal data or restriction of processing pursuant to Articles 18, 19 and 20 of the EUDPR, and notify such actions to recipients to whom the data have been disclosed. - [Publications Office of the EU](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R1725) — Under Article 22, the data subject has the right to receive personal data concerning him or her in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance. - [EDPS](https://www.edps.europa.eu/data-protection/data-protection/glossary/r_en) — The data controller must respond to a data subject's request for access to their personal data without undue delay and in any event within one month from receipt, which may be extended by two further months where necessary. - [Superintendencia de Protección de Datos Personales (SPDP)](https://spdp.gob.ec/wp-content/uploads/2026/05/PR_vulneraciones.pdf) — SPDP's October-2025 'Protección de Datos desde el Diseño y por Defecto' guide treats data portability as a right controllers must design systems to support. ### Ecuador: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully codified and actively supervised (breach-notification web-portal, DPIA lists, DPO dismissal-consent rules updated January 2026); no material gaps identified. Primary framework Regulation (EU) 2018/1725, Chapters III-IV Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Green Fully codified and actively supervised (breach-notification web-portal, DPIA lists, DPO dismissal-consent rules updated January 2026); no material gaps identified. Periodic update · new data 2026-10-18 #### Controller/Processor Duties The most notable controller/processor-facing development this cycle concerns not operators' own duties directly but the procedural framework under which the SPDP itself evaluates compliance. The SPDP's official LOPDP evaluation procedure applies an exceptional process for fiscal years 2024, 2025, 2026 and 2027, omitting the socialisation phase that would otherwise form part of a standard evaluation. This exceptional treatment is explicitly tied to the SPDP's own late operational start in September 2024, roughly three years after the LOPDP entered into force in 2021. The full standard evaluation procedure, including the socialisation phase, is not due to apply until fiscal year 2028 onward. For controllers and processors operating in Ecuador, this means the compliance-evaluation environment through 2027 is itself transitional: the SPDP is applying a procedure calibrated to its own institutional catch-up rather than the steady-state procedure that will eventually govern evaluations from 2028. No other controller/processor-specific duty, such as a DPIA threshold or accountability-documentation requirement distinct from this procedural point, was independently re-verified this cycle. #### Outlook The exceptional evaluation procedure is scheduled to give way to the standard procedure from 2028. Controllers and processors should expect the evaluation environment to tighten as that transition approaches, and should watch for any SPDP guidance clarifying how the exceptional-period evaluations conducted between 2024 and 2027 will be treated once the standard procedure takes effect. Periodic update · new data 2026-10-05 #### Controller/Processor Duties Ecuador's standing large-scale-processing threshold continues to govern when a controller or processor must conduct a data protection impact assessment and designate a data protection officer. Resolución SPDP-SPD-2026-0005-R establishes a six-point quantitative threshold that, once met, qualifies processing as gran escala and triggers both obligations. This threshold predates the current reporting window but remains the operative in-force rule, and it is confirmed at a high degree of confidence against the primary resolution text itself. Alongside this standing threshold, the SPDP is reported to have updated security-breach-management criteria among its four resolutions of 9 September 2026. The specific notification deadline and risk threshold introduced by this update have not been independently located; the headline fact of an update is attested only by secondary legal-press summaries rather than the primary resolution text, and the account here is accordingly hedged rather than assertive as to the detail of the new breach-management criteria. #### Outlook Retrieval of the primary text of the updated breach-management resolution would allow the specific notification deadline and risk-assessment criteria to be stated, closing the current gap between the confirmed headline update and the unconfirmed operational detail. D4 · Controller & Processor — Full Module Record 7 sub-modules · 52 words · 10 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ecuador: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is complete, but EUDPR itself does not generate adequacy decisions (it relies on GDPR Art 45(3)/LED Art 36(3) decisions) — a structural cross-reference rather than a gap, tracked here as amber for interoperability clarity. Primary framework Resolución SPDP-SPD-2026-0004 Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Amber Framework is complete, but EUDPR itself does not generate adequacy decisions (it relies on GDPR Art 45(3)/LED Art 36(3) decisions) — a structural cross-reference rather than a gap, tracked here as amber for interoperability clarity. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 50 words · 8 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ecuador: D6 Sectoral Watch7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Sectoral overlays are well-documented for financial-supervision and health agencies; credit-scoring and education have no dedicated EUI sub-regime, which is expected given the nature of Union institutions rather than a compliance gap. Primary framework Regulation (EU) 2018/1725, Art 25 (sector/agency-specific restriction decisions) Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Green Sectoral overlays are well-documented for financial-supervision and health agencies; credit-scoring and education have no dedicated EUI sub-regime, which is expected given the nature of Union institutions rather than a compliance gap. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 91 words · 6 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ecuador: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core cookie/consent-signal policy is in active reform (Digital Omnibus); several sub-modules are genuinely inapplicable to the EUI-controller context rather than gaps. Primary framework Directive 2002/58/EC (ePrivacy) read with Regulation (EU) 2018/1725, Art 36 Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Amber Core cookie/consent-signal policy is in active reform (Digital Omnibus); several sub-modules are genuinely inapplicable to the EUI-controller context rather than gaps. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 65 words · 3 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ecuador: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Mature, actively-resourced supervisory framework (dedicated EDPS AI Unit since Oct 2024, published AI Compass 2026-2027); amber risk only from the pending Digital Omnibus on AI timeline changes. Primary framework Regulation (EU) 2018/1725, Art 24; Regulation (EU) 2024/1689 (AI Act) as applied to EUIs Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Green Mature, actively-resourced supervisory framework (dedicated EDPS AI Unit since Oct 2024, published AI Compass 2026-2027); amber risk only from the pending Digital Omnibus on AI timeline changes. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The SPDP is understood to have issued Resolución SPDP-SPD-2026-0009-R as its first AI-specific rule, a notable development given Ecuador's data-protection framework had not previously addressed algorithmic governance as a distinct regulatory category. The resolution obliges entities that use AI systems processing personal data to adopt clear AI policies and to demonstrate documentation, controls and transparency over how their algorithms are supervised. This transparency obligation is reported through secondary legal commentary rather than confirmed directly against the primary resolution text, and the resolution's exact effective date has not been established this cycle. The same resolution is further reported to require entities to identify the AI systems they have in use, determine whether those systems process personal or sensitive data, and build a preliminary risk matrix organised by system type and impact. This risk-assessment component carries a lower confidence than the transparency obligation itself, resting on the same secondary commentary without independent confirmation from the primary text. Taken together, these two strands represent Ecuador's first attempt to bring AI-specific processing within its existing data-protection perimeter, rather than leaving algorithmic processing to be governed solely by the LOPDP's general provisions. #### Outlook Confirmation of the resolution's primary text, its exact effective date, and the precise scope of the risk-matrix requirement would substantially sharpen this picture. Until then, the transparency and documentation obligations should be treated as probable rather than fully confirmed, and the risk-assessment requirement as uncertain. Periodic update · new data 2026-10-05 #### Algorithmic, Biometric & Surveillance Governance Ecuador's AI-governance norm, Resolución SPDP-SPD-2026-0009-R, has been reformed by Resolución SPDP-SPD-2026-0037-R, with the reform falling within the 9 September 2026 window of SPDP resolutions. The reformed norm applies to any organisation that develops, trains, implements, deploys or provides AI systems processing Ecuadorian personal data, and it empowers the SPDP to audit such AI systems and impose corrective or precautionary measures. This is confirmed against legal-commentary reporting on the reform and represents an increase in the scope of provider and encargado responsibility for AI systems operating on Ecuadorian personal data. The same 9 September 2026 window is reported to have introduced a dedicated biometric-data norm, requiring genuinely free consent and a non-biometric alternative in asymmetric relationships, and restricting secondary reuse of biometric data without fresh consent or a valid sensitive-data condition. Read together, the AI-system audit power and the biometric-data consent and reuse restrictions represent a coordinated tightening of SPDP's algorithmic- and biometric-governance framework within a single reporting window, extending both the scope of what the regulator may audit and the conditions under which biometric data may lawfully be processed. The primary Registro Oficial text of both the AI-reform resolution and the biometric-data norm has not been directly retrieved this cycle; the account above rests on independent legal-press and legal-commentary summaries, and the degree of confidence in the specific obligations is calibrated accordingly, assertive where the sourcing is a direct quotation of commentary describing the audit power, and qualified where the detail is paraphrased. #### Outlook Continued attention to SPDP's exercise of the newly reported AI-audit power, once primary-source confirmation is available, would clarify whether the reformed norm's corrective and precautionary measures are being applied in practice against AI systems processing Ecuadorian personal data. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 67 words · 11 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ecuador: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core child-consent rule is codified and confirmed, but education-settings and dependent-adults sub-modules have no dedicated EUI content, and minor-specific profiling bans are inferred rather than explicit. Primary framework Regulation (EU) 2018/1725, Art 8 Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Amber Core child-consent rule is codified and confirmed, but education-settings and dependent-adults sub-modules have no dedicated EUI content, and minor-specific profiling bans are inferred rather than explicit. D9 · Children's Privacy — Full Module Record 5 sub-modules · 58 words · 3 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ecuador: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ EDPS enforcement toolkit is active and demonstrably used against major EUIs (including the European Commission itself); amber-adjacent risk stems only from pending Digital Omnibus changes to underlying substantive rules, not from an enforcement capacity gap. Primary framework Regulation (EU) 2018/1725, Arts 58, 65-66, 86 Supervisory authority [European Data Protection Supervisor (EDPS)](https://www.edps.europa.eu/) Traffic-light rationale — Green EDPS enforcement toolkit is active and demonstrably used against major EUIs (including the European Commission itself); amber-adjacent risk stems only from pending Digital Omnibus changes to underlying substantive rules, not from an enforcement capacity gap. Periodic update · new data 2026-10-18 #### Enforcement & Redress The defining fact of Ecuador's enforcement record is structural rather than episodic: investigative reporting by Primicias found that zero sanctions had been imposed under the LOPDP as of publication, despite the law having been in force since 2021. This is attributed to the LOPDP's own statutory design, under which the SPDP must first impose corrective measures for serious infractions and may only proceed to sanction where those corrective measures are not complied with. The corrective-measures-first requirement functions as a structural brake on sanctioning activity, distinct from, and prior to, any question of regulator capacity or caseload. Separately, the SPDP issued Resolución SPDP-SPD-2026-0038-R, with the underlying process initiated by a memorandum dated 3 September 2026. The substantive subject matter of this resolution has not been confirmed from the fragment of it retrieved this cycle, and it is recorded here as a dated development of unconfirmed scope rather than a described enforcement action. #### Outlook The central open question for Ecuador's enforcement trajectory is whether the SPDP has imposed any sanction since the Primicias zero-sanctions finding, which would mark the first substantive test of the corrective-measures-first design five years into the LOPDP's life. Equally relevant is clarification of what Resolución SPDP-SPD-2026-0038-R actually addresses, since its scope remains unconfirmed. Periodic update · new data 2026-10-05 #### Enforcement & Redress The SPDP sanctioned LIGAPRO on 20 January 2026 for failing to implement data protection by design and by default in its FAN ID application. This enforcement action is confirmed directly against SPDP's own press reporting, which states that the SPDP sanctions LIGAPRO for failing to implement data protection by design and by default. The specific monetary amount of the sanction has not been located, so the enforcement action is reported here as to its basis and target but not as to its quantum. This action sits alongside, and is the most recent enforcement precedent ahead of, the four resolutions the SPDP is reported to have issued on 9 September 2026 updating its complaints-handling and security-breach-management criteria. Together, the LIGAPRO sanction and the September resolutions indicate continuing and active use of SPDP's enforcement and rule-making powers within the current reporting window, with privacy-by-design and by-default obligations now attested as an enforceable standard in practice rather than only as a textual requirement. #### Outlook Locating the monetary amount of the LIGAPRO sanction, and the primary text of the updated complaints-handling criteria among the September resolutions, would complete the picture of how SPDP is calibrating both the severity of its enforcement response and the procedural rights available to complainants under the revised framework. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 116 words · 17 traced claims · Re-verified 2026-10-18 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action