Recording job interviews in Ecuador: COIP Article 178, LOPDP consent and the Superintendency's 2025 rules

Recording a job interview with a candidate in Ecuador needs a legal basis under the Organic Law on Personal Data Protection (LOPDP) and, in practice, the candidate's informed consent. Article 178 of the Comprehensive Organic Criminal Code (COIP) punishes recording another person's voice, audio or private communications "without consent or legal authorization" with one to three years in prison, though it does not apply to someone who discloses recordings in which they personally take part. The LOPDP requires telling the candidate the purposes, legal basis, retention period and recipients at the moment you collect the data (Article 12), and treats migration status, judicial record, health and biometric data as sensitive. The regulator is the Superintendency of Personal Data Protection (SPDP). This is the position as of November 2026.

This page adds Ecuador to our Latin American series alongside Colombia, Peru, Costa Rica and Panama. It is for recruiters, agency consultants and hiring managers who interview candidates located in Ecuador by video or phone, including from the US. It also covers two SPDP resolutions from 2025 that affect recruiters directly: the rules on legitimate interest and the duty to put data protection clauses in contracts.

Ecuador's rules at a glance

Is it legal to record a job interview in Ecuador?

Yes, with consent. Article 178 of the COIP, "violation of privacy," punishes "the person who, without consent or legal authorization, accesses, intercepts, examines, retains, records, reproduces, disseminates or publishes personal data, data messages, voice, audio and video, postal objects, information contained on computer media, or private or reserved communications of another person by any means" with one to three years in prison. Its second paragraph reads: "These rules do not apply to a person who discloses audio and video recordings in which they personally take part, nor to public information as provided by law."

The exception shows that a participant's own recording is not the main target, but it speaks of disclosing, and we found no official guidance on whether a participant who records a candidate without telling them falls under the first paragraph. The Constitution points the same way as the code: Article 66(18) says "the law shall protect the image and voice of the person," and Article 66(19) says collecting, processing or disseminating personal data "shall require the authorization of the owner or the mandate of the law." Tell the candidate, ask, keep a note of the answer, and stop if they say no.

What does the LOPDP require before you record?

The LOPDP applies when data is processed anywhere in Ecuador, when the controller or processor is domiciled there, and when a controller outside Ecuador processes data of people residing there in connection with offering them goods or services or monitoring their behavior in Ecuador (Article 3). Article 7 lists eight legal bases, including the person's consent "for one or several specific purposes," the "execution of precontractual measures at the request of the data subject," and a legitimate interest that is not overridden by the person's rights.

Consent is valid under Article 8 when it is "free," "specific," "informed" and "unequivocal," and it "may be revoked at any time without any justification being necessary," through a procedure as simple as the one used to collect it. Article 12 lists seventeen items the person must be told, including the purposes, the legal basis, the types of processing, the retention period, national or international transfers and their recipients, the consequences of refusing, the possibility of revoking consent, the rights and how to exercise them, how to complain to the Superintendency, and "the existence of automated assessments and decisions, including profiling." Where the data comes from the person, that information must be given "in advance, that is, at the very moment the personal data is collected." Put it in the invitation and repeat the short version on the call.

Can you rely on legitimate interest instead of consent?

Only with paperwork. Article 9 of the LOPDP limits legitimate-interest processing to data "strictly necessary" for the purpose, requires it to be transparent, and lets the Superintendency demand a risk report. SPDP Resolution SPDP-SPD-2025-0041-R of November 7, 2025 goes further. It prohibits legitimate interest as a basis for sensitive data (Article 16.1), requires an orderly, up-to-date register of balancing assessments available to the person and to the Superintendency, and says each assessment must be reviewed within one year and lapses automatically when the purpose, the data, the people concerned or the risks change (Article 18). Information about legitimate-interest processing must be "in clear, accessible, simple language and in Spanish" (Article 19). For interview recordings, informed consent is usually the simpler route.

The same resolution says, in its rules on video surveillance, that "in no case may audio recording be used for supervision, control of work performance or to capture private or sensitive conversations" (Article 15). It is written about surveillance cameras, not interviews, but it shows how the Superintendency views audio of workers: if you also record your own recruiters' calls, do it openly, for a stated purpose, and not to monitor their performance covertly.

What about migration status, judicial records and health?

Article 4 defines sensitive data as data on "ethnicity, gender identity, cultural identity, religion, ideology, political affiliation, judicial record, migration status, sexual orientation, health, biometric data, genetic data" and data whose misuse could lead to discrimination. Article 26 prohibits processing it unless an exception applies, such as the person's "explicit consent" with the purposes clearly specified, or processing necessary for obligations and rights "in the field of labor law and social security and protection." Migration status is the one recruiters most often touch: check work authorization as a separate, documented step, not in conversation on a recorded call. Do not ask about health, religion or criminal history in the interview, and keep anything volunteered out of notes and scorecards.

What must your contracts with clients and vendors say?

Resolution SPDP-SPD-2025-0006-R of April 30, 2025 makes it mandatory to include data protection clauses in contracts between the actors of the data protection system concluded in Ecuador. Its Annex I offers reference models for clauses between a controller and the data subject, a controller and a processor, a controller and a recipient, and joint controllers. Article 4 says a clause must not be vague, must not allow transfers "without adequate guarantees or without informing" the person in advance, and must not omit the retention period. For recruiters that means the agency-client agreement and the contract with any transcription or note-taking vendor need a data protection clause that covers recordings.

What if you interview a candidate in Ecuador from the US?

Article 3 can reach a controller outside Ecuador, and an Ecuadorian client or agency in the process is covered outright. The COIP protects the candidate's side of the call, and your own state's law governs your side; see two-party consent states. Sending a recording or transcript to a US vendor is an international transfer. Articles 56 to 60 allow it to countries the Superintendency has declared adequate by resolution, with adequate guarantees in a binding legal instrument, under approved binding corporate rules, with the Superintendency's authorization, or in exceptional cases that include the person's "explicit consent" after being told of the risks and transfers necessary for a contract or "precontractual measures adopted at the request of the data subject." Check the SPDP's resolutions page for adequacy decisions before relying on one, and name the vendor's country in your notice.

Can candidates get the recording, and what are the penalties?

Article 13 gives the person the right to obtain "free of charge" access to all their personal data and the Article 12 information "without the need to present any justification," and the controller must answer "within fifteen (15) days." Our guide to candidate data access requests covers what to send and what to redact. Fines for private-sector controllers and processors run from 0.1% to 0.7% of turnover in the previous fiscal year for minor infractions (Article 71) and from 0.7% to 1% for serious ones (Article 72), set by intent, repetition, harm and recidivism. Public servants face fines measured in basic unified salaries.

Can you use AI note takers or transcription?

Yes, with consent or a documented basis, an Article 12 notice that names the tool, a contract clause under Resolution 0006-R, a transfer mechanism for any vendor outside Ecuador, and short retention. Article 12 also requires telling candidates about automated assessments and profiling, so say so if a tool scores answers, and keep a person in the decision. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Ecuador

Antes de empezar: quisiera [grabar esta entrevista / usar un programa
que transcribe nuestra conversación] para registrar sus respuestas con
exactitud. [La grabación / La transcripción] se usará solo para este
proceso de selección, la verán únicamente [el cliente / el responsable
de contratación], se almacenará con [proveedor, país] y se eliminará
[plazo] después de la decisión. ¿Está de acuerdo? Puede negarse o
pedirme que detenga la grabación en cualquier momento, sin ninguna
consecuencia para su postulación.

(Before we start: I'd like to [record this interview / use software
that transcribes our conversation] to capture your answers accurately.
The [recording / transcript] will be used only for this hiring
process, seen only by [the client / the hiring manager], stored with
[vendor, country] and deleted [period] after the decision. Do you
agree? You can say no or ask me to stop recording at any time, with
no consequence for your application.)

Send the full Article 12 information in Spanish with the invitation, including how to complain to the Superintendency. More wording is in the interview recording consent script.

Checklist before you record interviews in Ecuador

• Candidate told before recording or live transcription starts, asked, and the answer noted.
• Article 12 notice in Spanish in the invitation: purposes, basis, retention, recipients, transfers, rights.
• Legitimate interest used only with a written balancing assessment, and never for sensitive data.
• No questions on migration status, health, religion or judicial record; work authorization checked separately.
• Data protection clauses in client and vendor contracts; a transfer mechanism for vendors abroad.
• Only calls you take part in are recorded; recruiters told before their own calls are recorded.
• Access requests answered within 15 days; retention period set and followed.