Cybersecurity law & regulation in Ecuador (2026)
Cybersecurity in Ecuador: comprehensive law.
Ecuador enacted its first standalone comprehensive cybersecurity law, the Ley Orgánica para el Fortalecimiento de la Ciberseguridad, approved by the National Assembly with 82 votes on 10 February 2026, cleared a partial executive objection in March 2026, and entered into force upon publication in the Official Registry on 22 May 2026. The law imposes cybersecurity obligations on public entities, digital service providers, and private operators of critical digital infrastructure, establishes a 78-hour incident-reporting duty, and sets tiered financial sanctions up to 1.5% of annual turnover. It complements Ecuador's 2021 personal data protection law (LOPDP) and the 2022 National Cybersecurity Strategy developed with OAS and EU Cyber4Dev support.
Legal framework
Ley Orgánica para el Fortalecimiento de la Ciberseguridad (Registro Oficial, Quinto Suplemento No. 290, 22 May 2026); supplemented by the Ley Orgánica de Protección de Datos Personales (LOPDP, 2021) and the National Cybersecurity Strategy (2022). Primary regulator: Ministerio de Telecomunicaciones y de la Sociedad de la Información (MINTEL) / CSIRT Ecuador.
Key points: cybersecurity in Ecuador
Comprehensive law in force (May 2026)
The Ley Orgánica para el Fortalecimiento de la Ciberseguridad was published in the fifth supplement of Registro Oficial No. 290 on 22 May 2026 and entered into force immediately, concluding a legislative process that began with the National Assembly's approval on 10 February 2026 and survived a partial presidential objection.
Scope of obligations
The law applies to public sector entities, digital service providers, and private legal entities responsible for critical digital infrastructure; natural persons are expressly excluded. It covers both domestic operations and cross-border digital services affecting Ecuador.
Incident-reporting duty (78 hours)
Covered entities must report cybersecurity incidents or attacks to competent authorities within 78 hours of becoming aware of them, a timeline broadly comparable to EU NIS2 obligations and significantly shorter than most Latin American peers.
Tiered sanctions regime
Infractions are graded minor (0.1-0.7% of turnover for companies; 1-10 SBU for public officials), serious (0.7-1%; 10-20 SBU), and very serious (1-1.5%; 20-40 SBU), with penalties applicable to both public and private entities.
CSIRT and governance framework
The law formalises the national CSIRT (Equipo de Respuesta a Incidentes de Seguridad Informática) under MINTEL oversight and aligns Ecuador's framework with ISO 27000 standards and the NIST Cybersecurity Framework, building on U.S., Ecuador cyber-defence cooperation exercises (CIBEREC 2025).
LOPDP personal-data breach notification (pre-existing, complementary)
Separately, the Organic Law for Personal Data Protection (LOPDP, 2021) requires data controllers to notify the Personal Data Protection Authority of a breach within five days of awareness; processors must alert controllers within two days. This data-protection channel operates in parallel with the new cybersecurity incident-reporting regime.
Timeline of decisions
- Law · officialLey Orgánica para el Fortalecimiento de la Ciberseguridad promulgated in Registro Oficial No. 290
After overcoming a partial presidential objection resolved by 83 assembly votes, Ecuador's comprehensive cybersecurity law was published in the Fifth Supplement of Official Registry No. 290 and entered into force. It establishes national digital-security standards, legally enables ethical hacking and penetration testing, mandates cybersecurity education in school curricula, strengthens CSIRT-Ecuador under the Ministry of Telecommunications, and sets incident-notification requirements for critical-infrastructure operators.
Ministerio de Telecomunicaciones y de la Sociedad de la Información
- LawLey Orgánica para el Fortalecimiento de la Ciberseguridad enters into force
Published in Registro Oficial Fifth Supplement No. 290, Ecuador's first dedicated cybersecurity law became immediately operative, mandating a 78-hour incident notification deadline, critical-infrastructure protection duties, compulsory cybersecurity education in schools, and concentrating strategic governance under MINTEL.
El Diario (Ecuador)
- Law · officialNational Assembly approves Organic Cybersecurity Strengthening Law with 82 votes
Ecuador's legislature passed the Proyecto de Ley Orgánica para el Fortalecimiento de la Ciberseguridad, creating a specialized regime for digital security, critical-infrastructure protection, and inter-institutional coordination between the Ministries of Government and Telecommunications and the National Police. The bill then faced a partial presidential objection before final promulgation.
Asamblea Nacional del Ecuador
- Law · officialNational Assembly approves Ley Orgánica para el Fortalecimiento de la Ciberseguridad (82 votes)
The Plenary approved Ecuador's first standalone cybersecurity law, reforming the Organic Telecommunications Law, the LOPDP, and several other statutes; a partial presidential objection (12 March) was overridden by 83 votes before the law was transmitted to the Registro Oficial.
Asamblea Nacional del Ecuador
- IncidentDual cyberattacks target Ecuador's National Assembly
Two coordinated intrusion attempts sought to access confidential legislative data days after Ecuador's general election; the Assembly contained both attacks and alerted public institutions, part of a broader campaign that also hit Radio Pichincha and the civil-registry system in the same period.
The Record (Recorded Future News)
- Law · officialEcuador becomes 77th Party to the Budapest Convention on Cybercrime
By depositing its instrument of accession, Ecuador joined the Council of Europe's principal cybercrime treaty, committing to harmonised criminal laws, cross-border digital-evidence sharing, and 24/7 mutual-assistance points of contact, the culmination of 2020-21 COIP reforms pre-aligned to the Convention.
Council of Europe
- IncidentCyberattacks from 7 countries disrupt Ecuador's overseas electronic voting
During snap presidential elections, attackers from India, Bangladesh, Pakistan, Russia, Ukraine, Indonesia, and China overwhelmed the CNE's telematic voting platform; only 51,623 of 120,000 registered overseas citizens could cast ballots, exposing critical gaps in electoral digital infrastructure.
The Record (Recorded Future News)
- Guidance · officialNational Cybersecurity Strategy (v1.1) adopted by the National Cybersecurity Committee
Resolution CNC-2022-007 approved Ecuador's first National Cybersecurity Strategy covering six axes, governance, cyber resilience, cybercrime, cyber defence, capability-building, and international cooperation, providing the strategic blueprint for the 2026 cybersecurity law.
MINTEL
- Guidance · officialNational Cybersecurity Policy published via MINTEL Ministerial Agreement 006-2021
Published in Registro Oficial Fifth Supplement No. 479, the policy established six strategic axes for a secure national cyberspace, designated MINTEL as cybersecurity coordinator, and set the governance foundation that directly produced the 2022 National Strategy.
MINTEL
- IncidentNovaestrat data breach exposes personal records of ~20 million Ecuadorians
A misconfigured Elasticsearch server at analytics firm Novaestrat exposed national IDs, financial records, vehicle data, and information on 6.7 million minors, affecting virtually the entire population, triggering the manager's arrest and fast-tracking the LOPDP through the legislature.
The Hacker News
- Law · officialLey Orgánica de Telecomunicaciones enacted, formalising ARCOTEL and EcuCERT's legal mandate
Published in Registro Oficial Third Supplement No. 439, the law created ARCOTEL as the unified telecoms regulator and gave legal grounding to EcuCERT, established by ARCOTEL resolution ST-2014-0247 in July 2014, as Ecuador's national CSIRT for coordinating telecommunications incident response.
ARCOTEL
- Law · officialCOIP enacted with Ecuador's first systematic cybercrime criminal framework
The Comprehensive Organic Criminal Code introduced Articles 178-234 criminalising unauthorised computer access, data interception, system-integrity attacks, and computer fraud with sentences of 1-5 years, replacing scattered provisions and forming the criminal-law backbone that was later harmonised with the Budapest Convention.
Council of Europe Octopus Cybercrime Community
Sources
- asambleanacional.gob.ec/es/node/113181
- asambleanacional.gob.ec/es/node/115246
- telecomunicaciones.gob.ec/asamblea-nacional-aprueba-el-proyecto-de-ley-para-el-fortalecimiento-
- eldiario.ec/ecuador/en-vigencia-la-ley-organica-para-el-fortalecimiento-de-la-cib
- eldiario.ec/ecuador/asamblea-nacional-aprueba-ley-organica-de-fortalecimiento-de-
- hayu.ec/2026/02/23/ciberseguridad-en-ecuador-hacia-un-nuevo-estandar-normativ
- infobae.com/america/america-latina/2026/02/11/el-congreso-de-ecuador-aprobo-la-le
- aena.com.ec/ecuador-aprueba-una-ambiciosa-ley-de-ciberseguridad-que-incorpora-la-
- dlapiperdataprotection.com/index.html?t=breach-notification&c=EC
- cyber4dev.eu/2022/06/17/ecuador-launches-national-cyber-security-strategy/
- thedefensepost.com/2025/11/05/us-ecuador-cyber-defense-resecurity/
- lexology.com/library/detail.aspx?g=3f76fe4b-4cf1-4de0-ad4f-5bbc519507b1
Next for Ecuador: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026