What Is LOPDP? Ley Orgánica de Protección de Datos Personales
Ecuador’s general data-protection statute is the Ley Orgánica de Protección de Datos Personales (LOPDP), published in Registro Oficial No. 459 on 26 May 2021. Its General Regulation was issued by Executive Decree 904 and published in Registro Oficial No. 435 on 13 November 2023. The law created the Superintendencia de Protección de Datos Personales (SPDP) as the control and sanctioning authority, and the SPDP’s current official materials show additional implementation rules and guidance. The LOPDP provides rights including access, rectification and updating, deletion, and opposition, with statutory response periods for several requests. Official SPDP materials also describe the authority’s control and sanctioning role, current rules for national and international transfers, and requirements affecting controllers or processors established outside Ecuador. The Spanish statutory text and implementing materials remain the controlling sources; this entry does not expand a provision beyond what the reviewed official sources support. No data-broker-specific registration system, people-search opt-out process, or broker-specific enforcement history was located in the official SPDP materials reviewed. A broker may still fall within the general controller or processor framework depending on its role, processing basis, territory, and transfer activity.
At a glance
- Full name
- Ley Orgánica de Protección de Datos Personales
- Short code
- LOPDP
- Jurisdiction
- Ecuador
- Enacted
- 2021
- Last major update
- The LOPDP was published on 26 May 2021 and its General Regulation was published on 13 November 2023. The SPDP resolutions index lists continuing 2025–2026 implementation rules, including 2026 standards on transfers, large-scale processing, artificial intelligence, biometrics, and breach notifications; no later amending act to the LOPDP itself was located in the reviewed official sources
- Regulator
- Superintendencia de Protección de Datos Personales (SPDP)
- Private right of action
- Limited
Scope, who LOPDP covers
Protected data
Data subject rights
Right of access to personal data and processing information; official SPDP guidance describes a free request without a justification requirement and a 15-day response period
Right to rectification and updating of inaccurate or incomplete data, with a 15-day response period and notification to recipients where applicable
Right to deletion when a statutory ground applies, including unlawful or unnecessary processing, expired retention, withdrawal of consent where relevant, or another applicable legal ground
Right to object to processing in the cases set out by the LOPDP, including direct marketing subject to the law’s exceptions and conditions
Rights relating to consent withdrawal, limitation, portability, automated decisions, and complaints as provided by the LOPDP and its implementing rules
Right to complain to the SPDP and to use applicable judicial remedies, including the constitutional habeas-data route in appropriate circumstances
Notable features
The LOPDP combines a broad rights framework with controller, processor, data-protection-officer, security, accountability, complaint, and international-transfer rules. The SPDP’s current resolutions page shows that implementation continues through rules on transfers, large-scale processing, artificial intelligence, complaints, and data-protection officers. The corrective and sanctioning regime became applicable after the statutory transitional period identified in official SPDP materials.
Enforcement & penalties
Regulator: Superintendencia de Protección de Datos Personales (SPDP)
Penalties: The LOPDP provides administrative sanctions and corrective measures, with the classification and amount depending on the infraction and whether the responsible party is private or public. A current official SPDP sanction notice identifies a 0.1%–0.7% of prior-year turnover range for a private entity’s light infraction and reports serious-infraction sanctions; that notice should not be read as a universal fine or as a prediction of an individual case outcome.
Private right of action: The constitutional habeas-data action and other judicial remedies provide a route for qualifying data disputes, and the SPDP provides an administrative complaint and sanctioning route. The reviewed sources do not establish a universal private damages action for every LOPDP violation; standing, remedy, and procedure are fact-dependent.
Relevance to data brokers
No official SPDP source reviewed identified a dedicated data-broker registration requirement, people-search opt-out workflow, public-record suppression route, or broker-specific enforcement history. A people-search or credit-adjacent service may nevertheless be subject to the general LOPDP controller or processor, rights, marketing, security, and international-transfer rules depending on the facts.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What is Ecuador’s main data-protection law?+
It is the Ley Orgánica de Protección de Datos Personales, published on 26 May 2021. Its General Regulation was issued in 2023, and the SPDP publishes subsequent implementation rules and guidance.
What can a person request from an Ecuadorian data holder?+
The LOPDP framework includes access, rectification or updating, deletion, and opposition rights, along with additional rights and complaint routes. Official SPDP materials describe a free access request and a 15-day response period.
Is there an Ecuadorian data-broker opt-out service?+
No dedicated people-search or data-broker opt-out service was located in the official SPDP materials reviewed. A request must be evaluated under the operator’s controller or processor role, the applicable legal basis, and the LOPDP rights and exceptions.
Official sources & citations
Other international privacy regimes
LOPDP sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: