The framework
The operative statute in Ecuador is the Organic Law on Personal Data Protection (LOPDP) (2021), enforced by the Superintendence of Personal Data Protection.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Organic Law on Personal Data Protection (LOPDP)
Ecuador's 2021 law is a faithful GDPR adaptation. Its Superintendence became the operating authority in April 2024 and has since issued rules on DPOs, sanction methodology, transfers, large-scale processing, biometrics and breach notification, backed by turnover-linked fine ceilings.
Marketing and advertising
GDPR-modeled bases with consent prominent; sanctions became applicable in 2023. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Transfers abroad need an adequate destination, appropriate safeguards or the individual's consent.
Enforcement and penalties
Serious violations bring fines up to 1% of prior-year revenue.