Ecuador

Art. 7 lists the lawful bases for processing and Art. 8 sets the standard for consent (free, specific, informed, unambiguous, withdrawable). Art. 12 lists the information to be given to data subjects. Arts. 13 to 17 give rights of access, rectification, erasure, objection and portability, with a 15-day response period stated for access, rectification, erasure and objection.

Art. 43 requires the controller to notify the authority (and the telecommunications regulator) no later than 5 days after becoming aware of a breach, and a processor to tell the controller within 2 days. Art. 46 requires notice to the data subject within 3 days of learning of the risk where their rights are at risk. Periods are stated as 'término' (working days).

Under Art. 30, in an electronic inspection the employer is notified at the email registered in the ministry's system and has 10 days to submit documents, with a single extension of 5 days. Art. 32 requires the procedure to end within 60 days of notice, with a closure order or a sanction resolution.

Art. 48 requires records of transactions, due diligence data, analyses, account files and business correspondence to be kept for ten years after the end of the contractual relationship, the last transaction or the occasional transaction. Art. 52 sets ten years for wire transfer information.

Art. 34 requires obligated subjects to run a risk programme to detect, prevent, mitigate and manage money laundering, terrorist financing and proliferation financing, validated by the supervisor and independently tested. Sub-paragraph (h) requires naming management-level staff in charge of compliance as liaison with the UAFE and the supervisor.

Art. 43 requires identification and verification of the client and of anyone acting for it, identification of the beneficial owner of legal persons and trusts, understanding of the purpose of the relationship and source of funds, and ongoing monitoring. Art. 44 lists the data needed for legal persons and trusts; Art. 45 allows verification to be completed later only exceptionally, within five days; Art. 47 bars starting the relationship if due diligence cannot be completed.