Uruguay. Breach notification. Decree
Decree 64/020Decree No. 64/020 regulating Articles 37-40 of Law 19,670
In force
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Implements the 2018 amendments: territorial scope for foreign controllers, privacy by design, impact assessments, security incident notification and the appointment of data protection officers.
- Key themes
- Unique features
DPO mandatory for public entities, private entities processing sensitive data as core business, and large-volume processors.
- SaaS relevance
Sets the concrete breach and DPO rules a SaaS provider serving Uruguay must follow.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- URCDP and data subjects (72h)
- DPO
- Conditional
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text impo.com.uy
- Authority
- Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC
§5Where it applies
- Domestic law of
- Uruguay
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.