Mandatory Technical Guide for the Registration of Special Agents for Joint or Independent Controllers, and Foreign Processors Engaged in Personal Data Processing Activities within the Republic of Ecuador (“Guide”), issued by the Superintendence of Personal Data Protection (“SPDP”). The Guide establishes the regulations for the mandatory registration of special agents who represent foreign controllers and processors involved in the processing of personal data in Ecuador. Below is a summary of the key points of this Guide:
1. Application:
• This Guide applies to all foreign controllers and processors (without domicile in Ecuador) who offer goods and/or services to data subjects residing in Ecuador; form part of the personal data protection system; or monitor behavior.
2. Special Representative:
• Foreign companies must appoint a special agent residing in Ecuador, who shall have broad authority to represent the company before Data Protection Authorities and ensure the protection of the rights of data subjects.
3. Requirements for the Special Agent:
• The agent may be a natural person (Ecuadorian or foreign resident) or a legal entity whose corporate purpose includes acting as a legal representative.
4. Power of Attorney Requirements:
• Foreign Controllers: Must include the trademarks or trade names that identify them.
• Foreign Processors: Must indicate the legal name of the controller(s) on whose behalf they process personal data.
• Additionally, controllers and processors must provide physical and electronic addresses, as well as phone numbers of their headquarters, along with identical contact information of their designated special agents in Ecuador.
5. Registration of the Special Agents:
• The special agent must be registered with the SPDP by submitting the document evidencing the granted power of attorney.
• If the power of attorney is issued abroad, it must be apostilled or certified by an Ecuadorian diplomatic or consular agent.
• The SPDP will verify that the power of attorney meets the requirements set forth in the Guide and, if deemed sufficient, will proceed with the registration; otherwise, it must be amended according to the observations made by the SPDP.
• The SPDP will publish the register of special agents and their contact details on its website. Regulated entities must also publish their contact details to facilitate the exercise of the data subjects’ rights.
6. Additional Obligations:
• The regulated entities must submit the following to the SPDP:
– A co-responsibility or processing agreement;
– Record of processing activities (RoPA);
– Risk analysis for each processing activity;
– Data flow diagrams for each processing activity;
– Details of security measures for the communication and transfer of data;
– Codes of conduct or self-regulation, if applicable.
7. Transitional Provisions:
• The regulated entities have six months (starting from September 6, 2024) to comply with this process.
• The application and special powers of attorney must be submitted to the SPDP’s offices until the electronic platform is enabled.
© TobarZVS
This publication contains information of general interest and does not constitute legal opinion on specific issues. Any analysis will require legal advice from the Firm.
