Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) 7: Art. 7 and RGLOPDP Art. 7: lawful bases for processing

Processing is lawful only on one of eight bases: consent for one or more specific purposes; a legal obligation of the controller; a court order (observing the Act's principles); a public-interest task or exercise of public powers conferred by a norm with the rank of law (subject to human-rights standards and legality, proportionality and necessity); pre-contractual steps at the data subject's request or performance of contractual obligations; vital interests of the data subject or another natural person; data held in publicly accessible databases; or the legitimate interest of the controller or a third party where the data subject's interests or fundamental rights do not prevail. The Reglamento requires public-task processing to define data types, data subjects, recipients, purpose limitation and retention and to be proportionate; vital interests may be relied on for another person only where no other basis applies (for example epidemics or humanitarian emergencies); legitimate interest needs a documented balancing (necessity and proportionality of the interest, impact on data subjects, provisional balance of the controller's measures, additional safeguards); and data from publicly accessible sources may only be processed for purposes compatible with those for which they were published.