What We Do
LOPDP and Regulation compliance
Comprehensive assessment and adaptation to Ecuador's Organic Law on Personal Data Protection and its Regulations.
Data Protection Officer (DPO)
Appointment of and ongoing support for the DPO function in accordance with current regulations.
Privacy policies and legal notice
Drafting of policies, privacy notices and terms aligned with the company's actual operations.
Consent management
Design of valid mechanisms for collecting and administering consent.
International data transfers
Structuring of data processing agreements and transfers to service providers abroad.
Incident response and data breach management
Response and notification protocols for personal data security breaches.
Who leads this practice
Leads HEKA's Data Protection practice, supporting companies in their adaptation to the LOPDP and in managing the regulatory risks associated with the processing of personal data.
View profile →
Leads the implementation of LOPDP compliance models, with prior experience providing specialized data protection advisory to local and international companies.
View profile →
Supports regulatory compliance processes in data protection and technology regulation, with a focus on digital compliance and Tech & TMT.
View profile →Practices that work alongside this area
Technology & TelecommunicationsDigital compliance, cybersecurity and technology contracts. Education LawProcessing of student and family data within educational institutions. CorporateData governance within corporate transactions and M&A operations.Common questions about data protection
Which companies must comply with the LOPDP?+
Any individual or legal entity that processes the personal data of clients, employees or users in Ecuador is subject to the LOPDP, regardless of its size or sector, although the specific obligations vary depending on the volume and sensitivity of the data processed.
Is it mandatory to appoint a Data Protection Officer (DPO)?+
The appointment is mandatory when the regulations require it based on the type and volume of data processed. We analyze your specific case and, where applicable, support the appointment and ongoing operation of this role.
What should my company do in the event of a personal data security breach?+
It must activate its internal response protocol, contain the incident, assess the risk to affected data subjects and, where applicable, notify the authority and the data subjects within the legal deadlines. We design these protocols before an incident occurs.
Can I transfer my clients' personal data outside Ecuador?+
Yes, provided that the transfer meets the conditions required by the LOPDP, such as obtaining the data subject's consent or implementing the transfer through data processing agreements that guarantee an adequate level of protection.