Regulation on the Pseudonymization, Anonymization, Blocking, and Deletion of Personal Data

By Robalino

Through Resolution No. SPDP-SPD-2025-0030-R, the Superintendency for the Protection of Personal Data issued the Regulation on the Pseudonymization, Anonymization, Blocking, and Erasure of Personal Data, which establishes guidelines for the application of these measures in accordance with the data lifecycle and the exercise of the rights provided for in the Organic Law on the Protection of Personal Data and its General Regulation.

 

Pseudonymization

Definition: The substitution of data with pseudonyms in such a way that the data subject cannot be identified without the use of additional information that is kept separately and protected.

Application: It may be used when supported by a lawful basis and following a risk management assessment in the provision of services where the identification of the data subject is not required.

 

Anonymization

Definition: A technical security measure aimed at preventing the identification or re-identification of the data subject.

Application: All categories of data may be anonymized, subject to a prior assessment of:

• Risk analysis and management methodologies.

• The state of the art, the specific characteristics of the processing, and the parties involved.

In health data: Anonymization is a priority and requires a prior risk assessment.

Blocking

Definition: A technical measure that disables access to personal data, preventing its processing.

Application: It may be applied as a form of backup once the purpose of the processing has been fulfilled, with restricted access and a risk assessment for its preservation.

 

Suspension

Definition: The temporary halt of processing activities without deleting personal data.

Application: It applies at the request of the data subject, provided that the conditions established in the Organic Law on the Protection of Personal Data (LOPDP) are met.

Timeframes: The controller must suspend processing within a maximum of three days and notify the processor to do so within the same period.

 

Erasure

Definition: The permanent and irretrievable removal of data.

Application: Applicable to all data, including that of deceased persons.

• The controller must provide the data subject with a document certifying the erasure of their data and the security measures applied. The processor must return or erase the data within a maximum of five days and provide the controller with proof of compliance.

 

Exceptions:

Processors or third parties may be exempted from erasing data if:

• They have a legitimate legal basis.

• They intend to carry out a new or different processing of data in the capacity of a controller.

The guidance to be published shortly will provide more detailed instructions on how to implement the measures described.

To read the full resolution, access it through the following link.