Small team, big mandate: Inside Ecuador’s data protection authority

This story is part of GovInsider's Digital Trust & Cybersecurity Champions 2026 Special Report.

Every day, Ecuadorian citizens hand over their personal information to banks, hospitals, ministries, and online retailers.

Someone has to make sure that data is handled responsibly, and that job falls largely to a team of 13.

That is the size of the core operational staff at the Superintendency for Personal Data Protection (SPDP), Ecuador’s data protection authority.

The whole institution has 38 people, and is responsible of overseeing every data controller and processor’s compliance with the national data protection laws.

Leading these efforts is the Superintendent General for Technological Innovation and Personal Data Security, Luis Enríquez, who does not see the small team limiting its ability to protect citizens’ data.

“We have endeavoured to develop our capabilities using available resources, and the results achieved reflect that effort,” he says to GovInsider.

He shares more about the SPDP’s approach and lessons learnt for global public agencies around what happens when a regulator has to build its authority, tools, and credibility all at once.

Starting from scratch

When the SPDP began operating, there was no institutional framework for data protection in Ecuador.

There was no registry, no secondary regulations, no enforcement procedures or technical infrastructure.

Enríquez highlights creating all of it “in a relatively short period” as one of the institution’s most significant achievements.

The output so far has been tangible. The Superintendency created its own regulatory framework, issuing more than 20 secondary regulations and three guidelines to facilitate risk management regarding personal data protection.

It also developed control mechanisms, corrective measures, and sanctioning procedures, translating policy on paper into actionable practices that organisations can adopt.

Enríquez notes that SPDP’s approach is risk-based, focusing on the areas of greatest exposure instead of trying to inspect every data controller equally.

Given the size of his team, it’s a strategic move.

Home-grown tools

The SPDP also decided to build its own tooling.

“We have developed in-house IT systems that now serve as fundamental tools for exercising our mandate,” shares Enríquez.

The first is the National Personal Data Protection Registry System (SISPDP), which allows SPDP to manage its relationships with data controllers and processors, and provide services to citizens and regulated entities.

The second is called AIxSPDP, an agentic artificial intelligence (AI) system that extracts and structures information, identifies patterns, generates metrics, and supports case management.

Enríquez notes that it operates under a "human-in-the-loop" model to ensure human oversight in final decision-making.

“All of this reflects a process of institutional building that has not been limited to creating an administrative structure, but that seeks to equip the country with concrete capabilities to regulate, oversee, and protect personal data in an increasingly complex technological environment,” says Enríquez. 

When “public” isn’t publicly available

One of the persistent challenges that SPDP deals with is legal, not technical, shares Enríquez.

“There is considerable confusion among public institutions that believe personal data becomes public simply by virtue of being in a public institution's records,” he says.

Ecuador’s Organic Law on Personal Data Protection (LOPDP) sometimes collides with the Organic Law on Transparency and Access to Public Information (LOTAIP).

While the first focuses on protecting individual privacy and controlling how personal data is collected and used, the latter applies only to government entities to make official records and state information open to the public.

Any government that has tried to balance openness with privacy may be familiar with this tension.

“There is much work to be done,” Enríquez acknowledges, on resolving these conflicts.

Dealing with the threat landscape

The main type of confidentiality incidents that SPDP deals with are related with social engineering and vulnerabilities in web applications.

Enríquez notes that data security breaches are frequent, and ransomware attacks are “very common” when it comes to availability.

“The Ecuadorian state still has a very low level of compliance maturity due to the absence of a robust data governance and interoperability structure,” he explains, adding that while institutions exist, they lack sufficient capacity.

In response, the SPDP works on institutional interoperability and cooperation so that agencies stop defending their data in isolation.

The road ahead

The Superintendency's budget reflects a stage of institutional consolidation, and no increase has been confirmed.

Strengthening its capacity to meet the country's growing needs on personal data protection is key focus ahead, says Enríquez.

But he sees a broader stake: protecting information and promoting responsible data use can help to counter phenomena like organised crime, “always within the scope of each institution's competencies and mandates,” he says.

“We consider it essential to continue coordinating efforts among the various State institutions, promoting a shared vision that enables the balanced strengthening of both security and the protection of citizens' rights and freedoms.”

For a young regulator with a staff of under 40 professionals, this is an ambitious agenda, but serves as a reminder that digital trust is built by the institutions willing to build it, one system and one regulation at a time.