Compliance en protección de datos personales en PYMES: obligaciones ignoradas y propuestas de cumplimiento progresivo

Abstract

This article analyzes the extent to which Ecuadorian SMEs comply with the Organic Law on the Protection of Personal Data and how they can move towards a compliance model compatible with their capabilities, using a qualitative, exploratory, and descriptive approach, a case study is conducted with two SMEs in the technology and video surveillance sectors, both of which process identification, contact, geolocation, and, in one case, biometric data. The study combines documentary analysis of the Constitution, the Organic Law on the Protection of Personal Data, its Regulations, and specialized doctrine with semi-structured interviews with executives and a review of privacy policies, contractual clauses, and internal information security practices. The results reveal partial and informal compliance, as intuitive protection measures exist, but there is a lack of records of processing activities, data protection officers, incident protocols, staff training, and written policies, despite these activities being classified as high-risk. However, there is a willingness to improve and to safeguard the trust of clients and employees; based on this, the work proposes a progressive compliance model in three levels (basic, intermediate and advanced) that seeks to reduce compliance gaps, prevent legal risks and contribute to a culture of peace in labor and commercial relations.