Key Aspects:
The Superintendency for the Protection of Personal Data (“SPDP”) has issued a new statement, through Official Letter No. SPDP-IGRD-2026-485-O, addressing the obligation of data controllers or processors not domiciled in Ecuador to appoint a Data Protection Officer (“DPO”).
This position is particularly relevant for foreign companies that process personal data of individuals residing in Ecuador, as it clarifies the compliance measures they must adopt when they are subject to Ecuadorian data protection regulations.
SUMMARY OF THE CONSULTATIONS ADDRESSED BY THE SUPERINTENDENCY
Consultation – Official Letter No. SPDP-IGRD-2026-485-O
Obligation of Data Controllers or Processors Not Domiciled in Ecuador to Appoint a Data Protection Officer
Statement:
The SPDP states that Article 3 of the Organic Law on the Protection of Personal Data (“LOPDP”) establishes the territorial scope of application of the law. Accordingly, a data controller or processor not domiciled in Ecuador is subject to Ecuadorian data protection regulations when the connecting factors set forth in that provision are met.
These include, among others, offering goods or services to data subjects located in Ecuador, monitoring or tracking their behavior, as well as circumstances in which the application of the law is warranted pursuant to a contract or obligations arising under public international law.
Article 48 of the LOPDP, in turn, establishes the obligation to appoint a DPO based on the nature, volume, scope, or purposes of the processing of personal data.
This provision does not establish an exception based on the foreign domicile of the data controller or processor. Therefore, when a foreign entity falls within the territorial scope of the LOPDP and the criteria triggering the mandatory appointment are met, the obligation to appoint a DPO is fully enforceable.
Differences Between the DPO and the Special Attorney-in-Fact
The SPDP distinguishes between these two roles:
The Special Attorney-in-Fact serves as a mechanism for representing the foreign entity before Ecuadorian administrative and judicial authorities and facilitates the exercise of data subjects’ rights.
The DPO, on the other hand, is a specialized compliance role responsible for advising on, monitoring, and overseeing compliance with personal data protection obligations, and acts as a point of contact with the SPDP.
In performing these duties, the DPO must act with professional independence.
These obligations are legally independent: the appointment of a Special Attorney-in-Fact does not replace the obligation to appoint a DPO, and the appointment of a DPO does not replace the Special Attorney-in-Fact.
At Bustamante Fabara, we will continue to provide specialized analysis on the practical application of these regulatory instruments and their implications for different regulated sectors.
For additional information, please contact:
