Ecuador

Art. 7 lists the lawful bases for processing and Art. 8 sets the standard for consent (free, specific, informed, unambiguous, withdrawable). Art. 12 lists the information to be given to data subjects. Arts. 13 to 17 give rights of access, rectification, erasure, objection and portability, with a 15-day response period stated for access, rectification, erasure and objection.

Art. 43 requires the controller to notify the authority (and the telecommunications regulator) no later than 5 days after becoming aware of a breach, and a processor to tell the controller within 2 days. Art. 46 requires notice to the data subject within 3 days of learning of the risk where their rights are at risk. Periods are stated as 'término' (working days).

Under Art. 30, in an electronic inspection the employer is notified at the email registered in the ministry's system and has 10 days to submit documents, with a single extension of 5 days. Art. 32 requires the procedure to end within 60 days of notice, with a closure order or a sanction resolution.

Art. 48 requires records of transactions, due diligence data, analyses, account files and business correspondence to be kept for ten years after the end of the contractual relationship, the last transaction or the occasional transaction. Art. 52 sets ten years for wire transfer information.

Art. 34 requires obligated subjects to run a risk programme to detect, prevent, mitigate and manage money laundering, terrorist financing and proliferation financing, validated by the supervisor and independently tested. Sub-paragraph (h) requires naming management-level staff in charge of compliance as liaison with the UAFE and the supervisor.

Art. 43 requires identification and verification of the client and of anyone acting for it, identification of the beneficial owner of legal persons and trusts, understanding of the purpose of the relationship and source of funds, and ongoing monitoring. Art. 44 lists the data needed for legal persons and trusts; Art. 45 allows verification to be completed later only exceptionally, within five days; Art. 47 bars starting the relationship if due diligence cannot be completed.

Art. 34 lit. g requires obligated subjects' risk programmes to include policies on creating and managing channels for complaints and reporting to the authorities. Art. 23.3 prohibits justice operators, parties, lawyers and third parties from requiring or revealing the identity of a UAFE analyst, on pain of administrative, criminal or civil liability, and extends the protection to compliance officers and staff of obligated subjects who took part in suspicious-transaction reports. This is not a general whistleblower protection regime.

Art. 52 applies to national and cross-border electronic transfers, including virtual asset transfers, by obligated subjects including virtual asset service providers. Originator and beneficiary information and an account or reference number must accompany each transfer or message, including batch transfers, and be kept for ten years.

Art. 4 numeral 18 requires accredited certification entities to submit to ARCOTEL each year, within the first 15 days of the year after the reporting period, an external information security audit report; the same entity may not be audited for more than four consecutive years. Numeral 20 requires new root or subordinate certificates, and each certificate type, to be sent to ARCOTEL for approval. The norm also refers to Art. 17 of the Reglamento General to the e-commerce law, under which certification entities register with the telecommunications regulator to obtain authorisation.