This research discusses some basic concepts and definitions concerning the protection of personal data and cybercrimes in the case of Ecuador and Mexico. First, key concepts like “hacker,” “ethical hacker,” and the significance of an Information Security Management System (ISMS) are examined. Afterwards, we analyze the legal framework for the two countries, detailing certain laws and their transformations over the years. Second, we analyze the principal cybercrimes in Ecuador, including some noteworthy cases against the financial and telecommunications sectors. Further, we analyze the classification of cybercrimes in the penal codes of Ecuador and Mexico, as well as the respective law enforcement bodies of each state and their relation to data protection. Third, a meaningful comparison between the legal framework of personal data protection for the two countries is made, establishing the similarities and diverging points of scope, principles, rights of data subjects, obligations of the data controller and eventual sanctions. Finally, we can conclude that the two nations recognize and take very seriously the need to combat risks of cybercrimes, as well as promote their own regime of privacy and security of information; however, many differences can be traced between the two jurisdictions in the way of sanctions, even crimes and numbers of charges.