RELEVANT ASPECTS:

Objective of the Guide: On September 6, 2024, the Superintendence of Personal Data Protection issued the Technical Guide, which establishes the requirements for foreign Regulated Subjects operating in Ecuador to Designate a representative in the country. This aims to ensure the protection of Ecuadorian residents’ data, facilitating the exercise of their rights and ensuring compliance with the personal data protection law by foreign entities.

Regulated Subjects required to comply with the Guide: Foreign Controllers, Joint Controllers, and Processors who, without being domiciled in the territory of the Republic of Ecuador, carry out the following activities:

1. Offer goods and/or services to data subjects residing in Ecuador.
2. Form part of the data protection system, regardless of whether they offer goods and/or services that require payment or are free.
3. Conduct monitoring of behavior of data subjects, to the extent that such control takes place in Ecuador, whether physically, virtually, or remotely.

Designation of Representatives:
Regulated Subjects must permanently have a representative in Ecuador with broad and sufficient powers to appear before administrative and judicial instances in matters of data protection. Additionally, the representative must manage the petitions or complaints of data subjects (attention to ARCO+ rights) according to the conditions of the LOPDP (Ecuador´s Data Act).

Requirements of the power of attorney granted to the representatives:
Regulated Subjects must include the following elements in the special power of attorney in the designation of the representative:

1. Corporate name and Tax ID
2. Trade name or brands used to distinguish their products or services.
3. In the case of foreign processors, they must also state the names of the controllers for whom they process personal data.
4. Electronic and physical addresses, and telephone numbers of their headquarters.
5. Electronic and physical addresses, and telephone numbers of their special attorneys-in-fact in Ecuador.

Requirements to be met by the attorney-in-fact:
The representative can be a natural person or a legal entity.

• Natural person: if the representative is a natural person, they must be Ecuadorian, and if foreign, they must reside in Ecuador and enjoy political rights.
• Legal entity: if the representative is a legal entity, it must have a corporate purpose that allows it to act as a proxy for the Regulated Subject.

Process of registering the representatives with the Superintendence:
Regulated Subjects must register their representatives with the Superintendence and present the document containing the special power of attorney.

If the power of attorney was granted abroad, it must comply with the following:

1. Include the corresponding apostille regulated by The Hague Convention.
2. Include a certificate issued by a diplomatic or consular agent of Ecuador resident in the State where the power of attorney was granted (in case the State in question was not a signatory to The Hague Convention).

The Superintendence will evaluate the power of attorney granted to the representative by the Regulated Subject to determine if it is adequate and sufficient according to the Guide’s parameters. The registration of the power of attorney will be carried out through physical and/or electronic means.

The Superintendence will publish on its website a guide of Regulated Subjects and their representatives with their contact details to facilitate the exercise of rights by data subjects.

Additional obligations:
Regulated Subjects must additionally present the following documents to the
Superintendence:

1. Joint controller agreement or data processing agreement.
2. Record of Processing Activities (RoPA) for each of the processing activities.
3. Risk Analysis for each data processing activity.
4. Personal data flow they carry out for each processing.
5. Details of the security measures implemented for data communication and
   transfer.
6. Binding Corporate Rules, if any, which must be approved by the Superintendence.

DEADLINE: Regulated Subjects must register their representatives with the
Superintendence within a period of six (6) months from the publication of the Guide in the Official Registry.

Until the Superintendence can enable the electronic platform for the registration of representatives, the application (with handwritten signature) and special powers of attorney must be submitted at the offices where the entity operates.

For more information, please contact us at the following emails:

María Rosa Fabara: mrfabara@bustamantefabara.com
Daniel Castelo: dcastelo@bustamantefabara.com
Esteban Dávila: edavila@bustamantefabara.com
María Mercedes Salgado: msalgado@bustamantefabara.com
Rafael Gabela: rgabela@bustamantefabara.com