Auditoría técnica del cumplimiento de la Ley Orgánica de Protección de Datos Personales en los sistemas de información del Core financiero de la Cooperativa de Ahorro y Crédito Credi Ya

Abstract

This research aimed to conduct a technical audit of compliance with the Organic Law on Personal Data Protection in the information systems associated with the Softbank financial core of Cooperativa de Ahorro y Crédito Credi Ya Ltda. The study was developed as a research project with a mixed and applied approach, using documentary review, surveys applied to employees and members/clients, semi-structured interviews with key personnel, and technical information systems audit tests. The audit considered criteria from the Ecuadorian personal data protection law and its regulation, together with ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27701, and NIST frameworks, applied to consent, data subject rights, breach management, impact assessment, access control, traceability, retention, providers, and technical security. The results show partial compliance: the cooperative has a relevant documentary basis, forms, subprocesses, and a risk methodology; however, it still needs to strengthen operational evidence, access recertification, user cleanup, segregation of duties, traceability of critical events, data minimization, and formal retention and secure deletion controls. As a final product, an audit report was prepared with prioritized findings and an action plan. It is concluded that compliance with personal data protection regulations must be managed as a continuous, measurable process supported by verifiable technical evidence.