Where Space Data Lands. Ground Stations and the Reach of Data Protection Law
During 2026 the conversation about privacy in outer space has turned toward orbit itself, as proposals for orbital data centres have led scholars, practitioners and the European Parliament’s foresight service to ask whether Article VIII of the Outer Space Treaty, which keeps a space object under the jurisdiction and control of its State of registry, could make that State a digital flag state for the data processed on board. That debate deserves attention, although it overshadows a more immediate fact, which is that almost all personal data collected or relayed by satellites still comes down to Earth through an antenna located in a specific country and subject to a specific data protection law. Under the Ground Station as a Service model, in which operators book antenna passes on demand and receive the data directly in the cloud, a single satellite may land data in several jurisdictions in one day, so the question of which law applies, and to whom, is increasingly answered at the antenna, and Ecuador, whose equatorial position makes it an attractive site for ground infrastructure, offers a useful case study because its law and the GDPR reach different results for the same downlink.
A single satellite may deliver data through ground stations in several countries, bringing one mission into contact with different privacy laws. Comparing the GDPR with Ecuador’s LOPDP shows why the antenna’s role, the treatment of return flows and the station’s access to readable data matter.
1.1 The antenna as the point of contact with the law
A ground station does considerably more than catch a signal, since it demodulates and decodes the stream, stores it in a local buffer, sometimes processes it further and delivers it to the satellite operator or its cloud provider, and when the payload contains personal data each of those steps is processing under Article 4(2) of the GDPR and under the equally broad definition of Ecuador’s Organic Law on Personal Data Protection (LOPDP). Such data is more common than often assumed, since very high resolution imagery can relate to identifiable people once combined with other datasets, satellite Internet of Things and maritime tracking signals carry location data often linked to individuals, and communications payloads carry human exchanges, so the station is the first place where that data becomes physically present within a national territory and within realistic reach of a supervisory authority.
1.2 Two laws, two answers to the same downlink
Under the GDPR the analysis turns on establishment, since Article 3(1) applies the Regulation to processing in the context of the activities of an establishment of a controller or processor in the Union, while the European Data Protection Board explained in its Guidelines 3/2018 on territorial scope that a controller established outside the Union does not become subject to the GDPR merely because it uses a processor in the Union. A station established in the Union therefore carries the obligations of a processor, whereas the foreign satellite operator remains outside the Regulation’s reach unless Article 3(2) applies because it offers goods or services to people in the Union or monitors their behaviour.
Ecuador’s LOPDP, enacted in May 2021, follows the European model in many respects, although its Article 3 applies the law to any processing carried out anywhere in the national territory, as well as to controllers and processors domiciled in Ecuador, to foreign ones that target or monitor residents of Ecuador, and to those bound by Ecuadorian law under a contract or public international law, while the General Regulation of November 2023 expressly covers those who handle data of people not residing in Ecuador whenever the processing takes place within the national territory. Read literally, these provisions mean that an Ecuadorian station downlinking images or telemetry captured over any country processes personal data under Ecuadorian law, which is unremarkable, and also that the foreign operator on whose behalf it acts could be treated as a controller subject to the LOPDP simply because its data touched Ecuadorian soil, a far more consequential proposition that the European framework deliberately avoids.
In my view the better reading of the LOPDP aligns with the European solution, under which the station remains fully subject to the duties of a processor, including acting only on documented instructions, ensuring security and confidentiality and signing a processing agreement, while the foreign operator does not become an Ecuadorian controller merely by booking an antenna pass. The broader reading would create duties no authority could realistically enforce, would discourage the use of Ecuadorian infrastructure and would add little protection for data subjects unconnected to Ecuador, so a clarification along these lines from the Superintendency of Personal Data Protection (SPDP) would give stations and their clients the legal certainty they need.
1.3 The return journey and the concept of transfer
The asymmetry reverses once the data leaves the station, because under the GDPR a processor in the Union that sends personal data back to its controller in a third country makes a transfer subject to Chapter V, as the Board confirmed in its Guidelines 05/2021, which is why the standard contractual clauses adopted by the European Commission in 2021 include a module for transfers from processors to controllers, and a European station working for an operator based outside the Union must frame the delivery of every downlink within the transfer regime.
Ecuadorian law follows a different path, since the LOPDP defines a transfer or communication as the disclosure of personal data to a person other than the data subject, the controller or the processor, and its Article 34 provides that a processor’s access to data in order to serve the controller is not a transfer or communication, a rule the SPDP has since developed when interpreting Articles 34 and 35. The return of downlinked data from an Ecuadorian station to its foreign controller, or to the controller’s cloud provider acting as a further processor, therefore does not, in principle, fit the legal definition of a transfer, and the General Rule on National and International Transfers of Personal Data issued by the SPDP in January 2026, with its tiered system of adequacy, appropriate safeguards, binding corporate rules, certification and the Iberoamerican Data Protection Network model clauses, would not govern that flow. Compliance then rests on the qualification of roles and on a processing agreement that reflects what the station actually does, since the General Regulation treats a processor that determines the purposes and means of a processing operation as a controller for that operation.
The result is close to a mirror image, with the GDPR narrower on scope and stricter on the return journey and the LOPDP, read literally, broader on scope and lighter on the return journey, a contrast that satellite operators and their advisers should understand before deciding where their data will land.
1.4 When the station cannot read what it receives
A growing number of operators encrypt payload data on board, using standards such as the Space Data Link Security protocol of the Consultative Committee for Space Data Systems, and retain the keys, so the station relays a stream it cannot read. The judgment of the Court of Justice of the European Union of 4 September 2025 in EDPS v SRB offers an argument for treating such a station differently, since the Court confirmed a relative approach under which pseudonymised data that remains personal for the holder of the key may not be personal for a recipient lacking the key and any realistic means of reidentification, and by analogy a station without the keys could argue that, from its own perspective, it processes no personal data at all.
That argument calls for caution, because the judgment concerned pseudonymised information disclosed to a recipient, commentators have counselled prudence before extending it to processors, the Court stressed that the controller’s own obligations remain intact, and in Ecuador the case law of the Court of Justice is only persuasive. The argument nonetheless carries practical weight, since the SPDP’s General Rule on Large Scale Processing of February 2026, which applies to controllers and processors alike, treats processing that involves geolocating data subjects as large scale by default, with the duties to carry out impact assessments and appoint a data protection officer, a qualification that a station able to read tracking data will find hard to avoid and that a station relaying only encrypted traffic can reasonably contest. Encryption under the operator’s exclusive control is therefore the most valuable safeguard in the ground segment, because it reduces the risk for data subjects whatever characterisation the station receives.
1.5 What operators and stations should do now
Satellite operators using stations in several countries should map every pass, identifying for each antenna the country, the station operator, the payload, whether the data travels encrypted and where decryption occurs, because the applicable law and the allocation of roles follow from those facts. Processing agreements with ground station providers should describe the service actually provided, confine the station to documented instructions, prohibit secondary use, limit retention in local buffers, treat delivery to cloud providers as subprocessing and set incident notification deadlines compatible with every jurisdiction involved, and a station that uses downlinked data for its own purposes, for instance to train models or sell analytics, should assume it has become a controller for that activity under both systems.
1.6 A regulator cannot board a satellite
As orbital computing matures, part of the processing will move to space and the debate about the State of registry will intensify, although the data that matters to people on Earth will keep coming down through antennas that sit on national territory, within reach of courts and supervisory authorities. A regulator has no practical way of boarding a satellite, while it can inspect a ground station at short notice, which is why the ground segment is likely to remain the place where data protection law and space activities meet most directly. Countries that wish to host ground infrastructure, Ecuador among them, would do well to adopt clear rules on roles and transfers for that segment, and privacy professionals advising satellite operators would do well to look down at the antenna before looking up at the orbit.
Article provided by INPLP member: Andrés Terán (HEKA LAW FIRM, Ecuador)