On Friday, May 21, the then President Lenín Moreno sanctioned the bill submitted by the National Assembly on May 10, 2021. The approved law has 77 articles distributed in 12 chapters, 9 general provisions, 4 transition provisions, 4 reforming provisions, 4 repealing provisions and a final provision.
This law is aligned with international standards, which helps Ecuador be considered a country with an “adequate level” of data protection by the international community and therefore can receive and transfer data more easily, thus generating foreign investment.
The Constitution recognizes and guarantees the right to protect personal data, which was superficially regulated by different regulations. The new Organic Law for the Protection of Personal Data gives a structure to the data protection system, broadens the legal basis for lawful processing, and formalizes the rights of data subjects and the obligations of data controllers and data processors.
It establishes corrective measures and fines for both the public and private sectors, up to 1% of the turnover in the private sector and up to 20 Consolidated Basic Salaries for the public sector.
In addition, it provides for the creation of a Superintendency of Personal Data Protection that will have as part of its powers the effective protection of the rights of the administered individuals and the issuance of guidelines and resolutions promoting an adequate treatment and exercise of rights.
Finally, although the law will enter into effect with its publication in the Official Register, the corrective and sanctioning regime will become effective two years after such publication.
During this period all companies or individuals acting as data controllers or data processors must adapt their data treatment to comply with the law.
Editorial Board
