Appointment of Data Protection Officer (DPO) for Savings and Credit Cooperatives
By Robalino

The Superintendent of Personal Data Protection (SPDP) of Ecuador has issued an official statement in response to a citizen inquiry, reaffirming the obligation of savings and credit cooperatives to appoint a Data Protection Officer (DPO).
Below, we highlight the most relevant points:
What is a Data Protection Officer (DPO)?
According to the Organic Law on Personal Data Protection (LOPDP), the DPO is the natural person responsible for:
-Supervising compliance with data protection regulations;
-Advising the data controller or processor;
-Cooperating with the Personal Data Protection Authority;
-Acting as the point of contact between the entity and the Authority.
Are cooperatives required to have a DPO?
Yes. According to the SPDP’s position, savings and credit cooperatives are part of the popular and solidarity financial sector, carry out large-scale data processing, and therefore are obliged to appoint a DPO in accordance with Article 48 of the LOPDP.
When must the DPO be appointed?
The appointment is not subject to any prior request from the Personal Data Protection Authority.
This obligation has been in effect since the entry into force of the LOPDP (2021) and its sanctioning regime (2023). Therefore, cooperatives must currently have a functioning DPO.
For further information, please feel free to contact our team of specialists: Pedro Córdova Balda, María Paula Arellano and Gabriela Holguín.