Issuance date: April 23, 2026
Issuing authority: Superintendency of Personal Data Protection

The Superintendency of Personal Data Protection (SPDP) presented its 2025 accountability report, emphasizing that it is already actively exercising its control and sanctioning powers.

The most relevant takeaway for organizations subject to the Organic Law on Personal Data Protection (LOPDP) is that the SPDP reported four sanctioning resolutions and monetary penalties exceeding USD 744,499.65. This demonstrates that regulatory risk in Ecuador is now tangible and that the authority has moved from a regulatory phase to the practical enforcement of measures.

Regarding oversight, the SPDP reported that during 2025 it registered seven administrative sanctioning proceedings, of which six were concluded and one was dismissed. Additionally, it reported 350 complaints filed, 49 data subject requests, and 21 cases of personal data breaches.

Supervisory activity also included 10 audits carried out on 15 entities, focused on verifying that the Data Protection Officer was properly appointed, qualified, and independent in the performance of their duties. Among the audited entities is the Property Registry of the Metropolitan District of Quito, along with other public entities, indicating that similar actions will be taken with private entities.

Conclusion

The SPDP already has secondary regulations in place, active supervisory enforcement, and significant economic sanctions. Compliance with data protection regulations in Ecuador must now be treated as a regulatory priority rather than merely a formal or documentary exercise. Companies must take data protection compliance seriously to avoid sanctions and reputational risks.

For further details, please contact our Personal Data Protection team.

This document does not constitute legal advice and is provided for general informational purposes only.
If you have any questions or require specific advice, please contact us at the following addresses: