Early childhood development centers and Ecuador's LOPDP: three special data categories in one form
Every enrollment form, psychomotor development record, evaluation report or session history managed by an early stimulation center is, under Ecuadorian law, sensitive data belonging to a priority care group. Ecuador's LOPDP does not treat it as ordinary data: it imposes specific obligations, concrete deadlines and real sanctions. And most early childhood centers in Ecuador have not yet initiated formal compliance.
Why these centers concentrate multiple special categories
Art. 25 LOPDP establishes four special categories of personal data with reinforced protection: data of children and adolescents; health data; sensitive data (including biometric and genetic); and data of persons with disabilities and their substitutes.
An early childhood development or stimulation center does not only handle the first of these categories: in many cases it handles all of them simultaneously. Psychomotor development records, neurological diagnoses, speech therapy evaluations, occupational therapy reports, photographs and videos of sessions, biometric data for access control. Each element activates specific obligations and multiplies the regulatory risk level.
When children's data, health data and disability data converge in the same processing operation, this is not one compliance problem: it is three simultaneous special categories. The protection regime is cumulative, not alternative.
The triple layer of requirements
1. Children and adolescent data
Art. 19 LOPDP Regulation establishes that processing data of children under 15 requires the legal guardian's consent. For sensitive data or automated decisions about minors, that consent must be express. Without documented consent, the processing has no legal basis. A poorly drafted form can nullify the entire legal basis for the processing, regardless of how many signatures it carries.
2. Health data
Art. 31 LOPDP requires that health data be processed under confidentiality and professional secrecy principles. For a stimulation center this has direct practical implications: therapist reports, progress records and any communication with external specialists are health data under the LOPDP. Storing them in shared folders without access control, sending them via unencrypted messaging, or delivering them to third parties without express guardian authorization constitutes violations of the law.
3. Disability data
Art. 25 LOPDP independently recognizes disability data as a special category. When a center works with children who have a diagnosed condition, the record of that condition is itself specially protected data — independent of also being health data and children's data.
Ecuador's LOPDP does not — as of this publication — establish a differentiated consent regime for disability data in minors beyond the legal guardian consent required for children's data processing. However, since these are also sensitive data under Art. 25 LOPDP, consent must be express. When in doubt, consult the SPDP or a specialist.
The obligation most centers don't know about: the Data Protection Delegate
Res. SPDP-SPD-2025-0028-R Art. 10 is explicit about entities obliged to designate a DPD, regardless of whether they are for-profit or not:
- Institutions of initial education, general basic education and high school
- Any institution that processes data of minors even if not operating in an educational context
- Any activity involving the processing of special category data related to minors
An early stimulation center that does not define itself as an educational institution still falls on this list. The obligation does not depend on the name of the establishment or its legal form: it depends on whether it processes children's data.
The DPD cannot be the center's director, a partner, or a relative within the fourth degree of consanguinity of the administrators. They must hold a university degree in Law, Information Systems, Communications or Technologies, and at least five years of accredited experience (Art. 55 LOPDP Regulation). They can be internal or external, provided their independence and direct access to the highest executive level is guaranteed.
The DPIA may also be mandatory for small centers
Res. SPDP-SPD-2026-0005-R classifies as large-scale processing — directly and mandatorily — two cases that apply simultaneously to these centers:
- Art. 14.1: Processing of health data within care systems, and other special sensitive data categories.
- Art. 14.5: Systematic processing of children and adolescent data in institutional, educational, digital contexts or in the provision of services directed at these priority groups.
The application of the "large-scale" qualification to small or medium-sized centers has not been the subject of an express SPDP ruling as of this publication. If your institution serves a small number of children, consult the SPDP or a specialist before assuming this qualification does not apply to you.
Compliance checklist: highest regulatory risk points
| Obligation | Legal basis | Typical status in the sector |
|---|---|---|
| Express consent of legal guardian for child's data | Art. 19, LOPDP Regulation | Frequently absent or verbal |
| Separate express consent for health data | Art. 26, LOPDP | No specific documentation |
| Separate express consent for disability data | Art. 25, LOPDP | No specific documentation |
| Privacy policy in plain language for families | Art. 24, LOPDP | Rarely implemented |
| DPD designation and SPDP registration | Arts. 10.1 and 10.3, Res. SPDP-2025-0028-R | Mostly pending |
| Activity Treatment Register (RAT) | Art. 44, LOPDP | Not structured |
| DPIA for systematic processing | Art. 42, LOPDP / Res. SPDP-2026-0005-R | Almost nonexistent in sector |
| Confidentiality protocol for therapists | Art. 31, LOPDP | No formal controls |
| Formal ARCO rights channel | Arts. 13-18, LOPDP | No defined channel |
| DPA with vendors (platforms, apps, cameras) | Art. 35, LOPDP / Res. SPDP-2025-0006-R | No processing agreements |
Does your institution comply with the LOPDP?
Wiibiq's free DataGuard diagnosis for early childhood development and stimulation centers identifies real gaps in the processing of children's, health and disability data, prioritizes actions and guides compliance without unnecessary technical jargon.
Request free DataGuard diagnosis →