The first fines have already been issued. The transition period ended three years ago.

We implement compliance with the Ley Orgánica de Protección de Datos Personales (Ecuador’s data protection act) through auditable deliverables, not a policy copied off the internet.

For two years the Ecuadorian market treated the LOPDP as a theoretical obligation. That period is over: the Superintendencia de Protección de Datos Personales (the data protection authority) has issued its first fines for serious infringement, in six figures and with an obligation to notify affected data subjects. What changed is not the statute, which has been in force since 2021 — it is that there is now an authority exercising its power to sanction.

The real exposure

Draft

The Superintendencia de Protección de Datos Personales has already shown that it exercises its power to sanction: the first serious fines arrived in six figures and with an obligation to notify affected data subjects. The exposure is not only the fine. A data breach with no protocol in place is handled on the fly in its first 24 hours, and a company with no documented legal basis for each processing activity cannot evidence good faith before the authority, even if it never acted in bad faith. The real cost lies in the late reaction, not in the event itself.

The nuance that sells better than fear

The Ecuadorian regime favors corrective measures over fines. A company with a reasonable program and evidence of good faith is in a very different position from one with nothing to show. We do not sell fear: we sell arriving prepared.

Verified figures you can cite

Sanctions regime enforceable since May 2023
Fines from 0.1% to 0.7% (minor infringements) and 0.7% to 1% (serious infringements) of annual turnover
First serious fines: LigaPro USD 259,644.01 and FEF USD 194,856.16

How we do it

Method and deliverables, with a written timeline for each step.

Step	What we do	What you get	Timeline
1 · Inventory	Mapping of personal data sets, purpose and legal basis	Record of processing activities (RoPA)	10 business days
2 · Gaps	Identification of gaps against the LOPDP	Prioritized gap report	10 business days
3 · Implementation	Closing gaps: contracts, clauses, protocols	Breach response protocol	30 business days
4 · Maintenance	Keeping the program current over time	Periodic review	Ongoing

Concrete deliverables

Draft

A record of processing activities (RoPA), the first document the authority asks for
A gap report prioritized by risk
A security breach protocol, with the first 24 hours scripted
A review of your legal bases for processing and of the processor clauses with your vendors
Ongoing maintenance of the program, so the evidence does not go stale
An initial LOPDP review, at no cost

How we charge for this service

Maintenance is what turns a compliance project into a program. Without it, the folder ages and the evidence stops being useful.

Before you write to us

Frequently asked questions.

Draft

Where does LOPDP compliance start if I have nothing in place?

With the inventory: what personal data your company processes, for what purpose, and on what legal basis. It is the first document the Superintendencia asks for.

Do I need a Data Protection Officer?

It depends on the volume and type of data your company processes. The initial review determines it.

What if I have already suffered a security breach?

The first-24-hours protocol exists precisely for that: to contain it, assess it, and decide whether the data subjects and the authority must be notified.

Do my current vendor contracts already comply?

Rarely. The processor clause is often missing even in contracts that are well drafted otherwise — we review them as part of the assessment.

How long does the full program take to implement?

Inventory in 10 days, gap report in a further 10, implementation in 30, and ongoing maintenance thereafter.