Diseño de un sistema de gestión de protección de datos personales para la Cooperativa de Ahorro y Crédito Achik Inti Ltda.

Abstract

Achik Inti Ltda. Savings and Credit Cooperative processes personal and credit data of its members without having a formal system in place to guarantee compliance with Ecuador’s Organic Law on Personal Data Protection (LOPDP, by its acronym in Spanish). This research aimed to design a personal data protection management system for the organization, aligning the requirements of the LOPDP with the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27701 standards, as well as the MAGERIT version 3 risk analysis methodology. The study, of an applied and projective type with a non-experimental, cross-sectional design and a mixed approach, developed a diagnostic assessment using a structured survey consisting of fifty-five items organized into ten control domains, administered to all heads of the four technical areas (n = 4), as well as an inventory and evaluation of twenty-four information assets. The results revealed an overall compliance rate of 62.7%, with critical gaps in incident management (16.7%) and the compliance domain (25%), as well as thirteen assets with very high criticality. Based on this evidence, the proposal was designed: a manual of policies and procedures, a matrix of roles headed by the Data Protection Officer, a risk matrix with its treatment plan, and the record of processing activities, all structured according to the plan, do, check, act (PDCA) cycle. The proposed system offers the cooperative a verifiable path toward the proactive and demonstrated accountability required by Ecuadorian regulations. Keywords: personal data protection; LOPDP; management system; risk analysis; savings and credit cooperative