Ecuador LOPDP Articles 37-45 Security + Processor + Breach Notification. Article 37 Security of Processing (Seguridad del Tratamiento) - controllers and processors must implement appropriate technical and organisational measures proportionate to risk + nature of data + state-of-the-art + including: (a) pseudonymisation + encryption (at rest AES-256 + in transit TLS 1.3 minimum); (b) confidentiality + integrity + availability + resilience of systems; (c) timely restoration of availability and access after incident; (d) regular testing + assessment + evaluation. Article 38 Documented Security Measures. Article 39 Processor Agreements - written contract specifying categories + purposes + duration + obligations including: process only on documented instructions + confidentiality + security + sub-processing prior authorisation + Data Subject Rights support + breach notification + return or deletion at termination + audit rights + flow-down. Article 40 Joint Controllership. Articles 41-43 Personal Data Breach Notification (Notificacion de Vulneracion) - obligation to notify SPDP within 72 hours of awareness where likely to result in risk to rights and freedoms + notify affected Data Subjects without undue delay where likely high-risk + content (nature + categories + approximate number + likely consequences + measures taken or proposed + DPO contact). Article 44 Records of all breaches whether notified or not. Article 45 Incident Detection and Handling + EcuCERT (Ecuadorian Centre for Cybersecurity Response) coordination + Ministry of Telecommunications and Information Society coordination + sectoral CSIRTs + tabletop exercises mandatory + Centro de Coordinacion de Ciberseguridad (CECIBER).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.