The deadline for registering Data Protection Officers (DPOs) with Ecuador’s Superintendency of Personal Data Protection is now two weeks away, on December 31, 2025.
Resolution No. SPDP-SPD 2025-0028-R regulates the responsibilities of DPOs in Ecuador, supplementing the Organic Law on Personal Data Protection and its Regulations, and introduces key features such as:
– Mandatory DPO appointment: among other examples, the requirement applies when there is need for permanent and systematic monitoring of processing activities, whether due to their volume, nature, scope, or purposes. The new Resolution expressly mentions financial, insurance, and pharmaceutical activities (the latter limited to the distribution and sale of medicines), healthcare agents who are required to maintain their patients’ medical records, sports entities and companies that engage in profiling for advertising, commercial prospecting, or market research activities, as well as activities involving mass surveillance, geolocation, or information technology, including artificial intelligence deployers.
– Requirements to be DPO: the appointee must be over the age of 18; have a degree in law, information systems, communication, or technology; have more than 5 years of professional experience; and have full political rights. These political rights are not specified in the Resolution, or whether these are political rights pertaining to Ecuador; however, it is expected that the Superintendency will allow foreigners to register as DPO, as the form already permits using the DPO’s passport number as identification.
– Conflict of interest: The Resolution imposes strict conflicts of interest provisions, establishing that the DPO will advise and supervise, but not implement or be involved in, the operation of the Data Protection Program. In addition, the appointed DPO cannot hold the position of Information Security and Compliance Officer.
DPO registration can be done online on the Superintendency’s website, but fully complying with regulatory requirements needs specific documentation that, considering the rapidly approaching deadline, should be provided as soon as possible.
Our Technology, Privacy, and Data Protection Team is available to answer any questions and provide support for obtaining mandatory registration.