Ley Organica de Proteccion de Datos Personales — international transfers and communications of personal data

Ecuador built a full GDPR-shaped transfer chapter: transfer is permitted to countries the Superintendencia de Proteccion de Datos Personales has declared adequate (Art. 56); failing that, on adequate safeguards such as contractual clauses (Art. 57) or binding corporate rules (Art. 58); failing that, on prior authorisation from the SPDP for cases the chapter does not contemplate (Art. 59) or on the exceptional grounds in Art. 60, with the SPDP retaining power to review and withdraw an adequacy finding (Art. 61). The operative detail arrived late: the SPDP issued its General Rule on national and international transfers by Resolution SPDP-SPD-2026-0004-R in January 2026, which is the document that sets the actual conditions and requirements. Marked 'check': the operative texts are Spanish-language, the article numbering was triangulated rather than read in the original, and the 2026 Resolution is new enough that practice around it is unformed.