Catalog

Ecuador SPDP rule on personal data in AI systems (SPDP-SPD-2026-0009-R)

Superintendencia de Protección de Datos Personales (SPDP) · pack 0.2.0 · verified against the official source as of 2026-10-02. Open it in the explorer.

Binding law — in force

Tell data subjects when AI systems process their data, for what purposes, and that the processing is automated (Ecuador, SPDP Resolution 2026-0009-R Art. 5.1)

From 2026-03-10, Ecuador's SPDP general rule on personal data in AI systems (Resolution SPDP-SPD-2026-0009-R) Art. 5.1 requires controllers and processors that process personal data in AI systems to inform the data subject clearly, specifically, determinately and transparently about the processing carried out through AI systems, including its purposes and its automated nature. It binds anyone who develops, trains, implements, deploys or provides AI systems processing Ecuadorian data subjects' data, wherever located. Detect a privacy notice that never describes the AI processing and its automated nature.

ec-spdp-ai.ai-processing-information · Resolution SPDP-SPD-2026-0009-R, Art. 5 opening and 5.1 (inform the data subject of processing through AI systems, its purposes and automated nature) · official source · jurisdictions: EC

The guard to add, and how far to trust this rule

Binding law — in force

Risk management and an impact assessment before developing an AI system that processes personal data (Ecuador, SPDP Resolution 2026-0009-R Arts. 5.2, 6)

From 2026-03-10, Ecuador's SPDP rule on personal data in AI systems requires controllers and processors, before developing an AI system that processes personal data, to carry out risk management and an impact assessment under the LOPDP, its General Regulation and SPDP rules (Art. 6), and to carry out risk management and impact assessments for personal data protection when processing personal data in AI systems (Art. 5.2). An organizational duty: the assessment is a document, not code.

ec-spdp-ai.assessment-before-development · Resolution SPDP-SPD-2026-0009-R, Art. 6 (risk management and impact assessment before developing the AI system) · official source · jurisdictions: EC

The guard to add, and how far to trust this rule