What should a financial institution in Ecuador review under the LOPDP before automating a process with AI?

Before automating a process with AI, a financial institution in Ecuador needs to confirm that each use of data has a legal basis, that the system uses only the data it needs and that its vendors and any transfers abroad are covered. If the process prepares or makes decisions that affect customers, such as approving a loan, it also needs genuine human review, a way to explain the decision, a prior impact assessment and a record of what the system did.

The reference point is the Organic Law on Personal Data Protection (LOPDP), published in the Official Registry on May 26, 2021, and its general regulation, issued in November 2023. In March 2026, a rule from the Superintendency of Personal Data Protection (Resolution SPDP-SPD-2026-0009-R) was also published, applying those rules to artificial intelligence systems. Among other things, that rule requires informing data subjects when their data is processed with AI and auditing the system according to its risk level. It applies even when the system or the vendor is outside the country.

Imagine a mid-sized bank that wants to pre-approve consumer loans in its app with a model that analyzes each customer's account activity. Before opening it to all customers, the team should be able to answer the questions below.

What legal basis supports each use of data?

The LOPDP lists the conditions that make processing lawful. Among them are consent for specific purposes, compliance with a legal obligation, pre-contractual measures requested by the data subject or the performance of a contract, and the controller's legitimate interest when the data subject's rights do not prevail. The practical question is which one applies to each use, because the same data can have several purposes.

In the bank example, analyzing a customer's transactions to respond to the loan application they submitted can rest on pre-contractual measures. Using every customer's history to train the model is a different processing activity, with a different purpose, and the law requires each new purpose to have a ground that enables it. There are also special rules for sensitive data, such as biometrics, and for credit data.

Does the system use only the data it needs?

The principle of relevance and data minimization requires data to be limited to what is strictly necessary for the purpose. In an AI project it is easy to break without noticing: the full database gets connected because it is faster, entire conversations are stored just in case, or documents are sent with more information than the model needs.

These questions help sort it out:

• Which fields does the model actually use for its task, and which ones arrive only because they sat in the same table?
• Can you mask or pseudonymize identifying data in testing and training?
• How long are inputs, outputs and logs kept, and who deletes them?
• Could the model infer sensitive data, such as health or ethnicity, from data that looks harmless?

What about AI vendors and data that leaves the country?

AI projects commonly depend on outside vendors, such as a cloud model or an identity validation platform. Under the law, that vendor is usually a data processor, and its work must be governed by a contract stating that it will process the data only on your instructions, will not use it for other purposes or share it with others, and will return or destroy it when the service ends.

If the servers are outside Ecuador, there is also an international transfer. The LOPDP allows it to countries or organizations that the authority declares to have an adequate level of protection, or with adequate safeguards set out in a binding legal instrument, or through binding corporate rules. In other cases, the authority's authorization is required. Before signing, ask the vendor in writing where the data is processed and stored, whether it uses the data to train its own models, which subcontractors are involved and how long it keeps logs.

When does an automated decision need human review?

The LOPDP recognizes the right not to be subject to decisions based solely or partially on automated assessments, including profiling, when they produce legal effects or harm the data subject's rights and freedoms. To exercise it, the person can request a reasoned explanation, submit observations, learn the assessment criteria and the types of data used, and challenge the decision. The law provides exceptions, for example when the decision is necessary to enter into or perform a contract or is based on the data subject's explicit consent. Even so, the 2026 rule calls for guaranteeing this right at all times when data is processed directly in AI systems, so the prudent course is to design human review from the start.

A denied loan, a reduced credit limit, a rejected insurance policy or an account frozen on suspicion of fraud are decisions with effects on the customer. For each one, define:

• A person with real authority to change the decision.
• The information the system used and the reason for its recommendation, in terms that person can evaluate.
• A clear channel for the customer to request the explanation or challenge the decision, with known response times.
• Sample reviews of the decisions the system made without intervention, to catch errors and bias.

When is an impact assessment mandatory?

The LOPDP calls for an impact assessment when processing is likely to pose a high risk to the data subject's rights and freedoms. It makes the assessment mandatory, among other cases, when there is a systematic and extensive evaluation of personal aspects based on automated processing, such as profiling, that leads to decisions with legal effects. A model that pre-approves loans usually fits that case. The assessment must be done before processing begins; the 2026 rule calls for it even before the system is developed.

A useful assessment describes the process and its data, justifies why the processing is necessary and proportionate, identifies concrete risks (classification errors, bias against certain groups, leaks of sensitive data, unintended uses) and defines measures to reduce them, with owners and dates. If you have a data protection officer, involve them from the beginning.

How do you show afterward what the system did?

Among the LOPDP's principles is proactive and demonstrated accountability: the institution must be able to prove that it complies. In a system with AI, that translates into traceability. For each case you should know which data went in, which model version responded, what it proposed, who reviewed it and what was decided. The 2026 rule also requires including in the record of processing activities the automated decisions that produce legal effects or affect rights, and making that record available to the Superintendency.

With that record you can respond to a complaint, a request for an explanation or an audit without reconstructing the story from memory. It also helps you notice in time if the model starts behaving differently. Keeping it up is part of operating the system, like backups, and it is one of the tasks Technology operations covers.

This summary of general obligations does not replace a review by your legal team or your data protection officer; our data protection page explains how we handle information. If you are about to automate a process, start by listing the data it will use, its sources and its vendors, and let's talk with that list at hand. In the diagnostic stage of our operating model we review these points before integrating any system.