Resolution No. SPDP-SPDP-2024-0002-R

Resolution No. SPDP-SPDP-2024-0002-R (“Resolution”), published in the Official Gazette No. 640 on September 10, 2024, the Data Protection Authority (“SPDP” or “Authority”) issued the “Mandatory Technical Guide for the Registration of the Attorney-in-fact designated by Controllers, whether acting individually or jointly, and Processors that engage in Data Processing Activities in the Republic of Ecuador” (“Guide”).

The following are highlighted:

1. The Guide is mandatory for all controllers and processors who, although not domiciled in Ecuador, offer goods or services to residents of the country, are part of the personal data protection system, or control the behavior of data subjects to the extent that such control occurs within the territory (“Regulated Entities”).
2. The Regulated Entities must designate an attorney-in-fact (“Attorney-in-fact”) on a permanent basis. The Attorney-in-fact must be vested with broad faculties to represent them before administrative and judicial bodies on data protection matters. In addition, the Attorney-in-fact must handle requests or complaints from data subjects without limitations that could affect their rights.
3. The power of attorney must detail the commercial name and the brands identifying the foreign controller in the market. Foreign processors must also detail information regarding the controllers for whom they process data. Both controllers and processors must provide their addresses and telephone numbers for their offices and those of their Attorney-in-fact designated in Ecuador.
4. In case of non-compliance with these obligations, the individuals or entities who, under certain circumstances, appear to act on behalf of the Regulated Entities may be held administratively liable. The Authority may impose and apply corrective measures established in the Data Protection Law and its Regulations.
5. The Attorney-in-fact can be an individual or a legal entity domiciled in Ecuador. If the Attorney-in-fact is an individual, they must be Ecuadorian or, if foreign, a resident in the country with full political rights. When the Attorney-in-fact is an entity, its corporate purpose must allow it to act as Attorney-in-fact. The SPDP may verify with the Superintendence of Companies that the entity meets its obligations, and that the appointment of the legal representative is valid.
6. Regulated entities must register their Attorney-in-fact with the SPDP by presenting the document granting the power of attorney. If the power of attorney is granted abroad, it must be apostilled or certified by an Ecuadorian diplomatic agent. Powers of attorney in a foreign language must be translated into Spanish.
7. The SPDP will verify that the power of the Attorney-in-fact meets the Guide’s requirements and assess whether the power of attorney granted is adequate and sufficient. If it is approved, registration will proceed, and the Regulated Entity will be notified. The registration of the Attorney-in-fact, along with their contact details, will be published on the SPDP’s website and that of the Regulated Entities to facilitate the exercise of data subjects’ rights.
8. The Regulated Entities must update their Attorney-in-fact registration in the following cases: a) death; b) resignation; c) expiration of the power of attorney, if applicable; d) change in the denomination, absorption, split, transformation, dissolution, or liquidation of the entity designated as the Attorney-in-fact. Except for the death of the Attorney-in-fact, the registered Attorney-in-fact will continue to be liable before the SPDP and the data subjects until the registration is updated.
9. All controllers and processors performing data processing abroad must present the following to the Authority:

• • The co-responsibility or data processing agreement.
  • The Record of Processing Activities (ROPA).
  • Risk analysis for each processing activity.
  • Dataflow of personal data for each processing activity.
  • Security measures implemented for data transfers.
  • Self-regulation codes, if any, must be approved by the Authority.

Transitional provisions of the Resolution establish the following:

1. Regulated Entities engaged in processing activities since September 6, 2024, are granted a six-month period from the issuance of the Guide to comply with the registration of their Attorney-in-fact.
2. The Authority will initiate the corresponding administrative control processes if an Attorney-in-fact is not registered within the period.
3. The application for registration of the Attorney-in-fact must be submitted in person at the Authority’s office.