Data Protection in Ecuador: Who Does It Apply To?

Did you know that Ecuador’s Organic Law on Personal Data Protection (LOPDP) may also apply to your business, even if you are not a large company?

If your organization has employees, customers, suppliers, or users, uses security cameras, operates a website, or communicates through corporate WhatsApp, you are probably processing personal data.

The LOPDP regulates how personal information is collected, used, stored, shared, and deleted, whether it is handled physically or digitally. Compliance is not simply a matter of publishing a privacy policy on a website; it requires incorporating data protection measures into the organization’s activities.

Do you think this law only applies to large companies?

Personal data protection is part of everyday activities:

• Daycare centers and schools: Handle information about children, parents, and families.
• Clinics and healthcare professionals: Process medical records, test results, and other health data.
• Employers: Collect personal information about their employees.
• Gyms: May process health data and other personal information about their members.
• Security companies: Capture and store images through video surveillance systems.
• Apps and digital platforms: Collect information about their users.

The LOPDP was not created solely to protect large companies’ databases. Its purpose is to protect individuals’ rights and establish obligations for those who process personal data.

Who does the LOPDP apply to?

Depending on the circumstances of the processing, the law may apply to companies, schools, universities, daycare centers, clinics, employers, financial institutions, apps, businesses using video surveillance, building management entities, and public institutions, among others.

The question is not simply whether you are a company; the right question is whether you process personal data.

At Quevedo & Ponce, we provide specialized personal data protection advice to help organizations identify their obligations and establish appropriate compliance measures under Ecuador’s Organic Law on Personal Data Protection.

If your company, educational institution, clinic, or business processes personal data, contact us for legal advice and guidance on implementing data protection measures tailored to your activities.