Uruguay. Comprehensive data protection. Law
Law 18.331Law No. 18,331 on Personal Data Protection and Habeas Data Action (Ley de Protección de Datos Personales y Acción de Habeas Data)
Partly verified
Medium confidence.72h figure and UI fine cap from general knowledge; DLA Piper confirms 'without undue delay'. Uruguay ratified Convention 108 and Protocol 223 (not re-verified).
§1Summary
- Synopsis
Uruguay's comprehensive data protection law covering public and private sectors, with consent-based processing, data subject rights, database registration and transfer restrictions, updated in 2018 toward GDPR standards.
- Key themes
- Unique features
EU adequacy since 2012; 2018 reform extended application to foreign controllers offering goods/services to or profiling people in Uruguay.
- SaaS relevance
Foreign SaaS providers targeting or monitoring individuals in Uruguay are in scope and must register databases and appoint a DPO in prescribed cases.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- URCDP without undue delay (Decree 64/020: within 72h) and data subjects
- DPO
- Conditional
- Cross-border transfers
- Adequacy (EU/EEA etc.), contractual clauses, consent
- Maximum penalty
- Fines up to 500,000 UI (indexed units); suspension/closure of databases
§3Dates
- Key dates
- Adopted
- In force
- Decree 414/009 (2009); Law 19,670 (2018) arts. 37-40 added extraterritorial scope, breach notification and DPO; Decree 64/020 (2020) implements them
§4Text and authority
- Text
- Authoritative text impo.com.uy
- Authority
- Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC
§5Where it applies
- Domestic law of
- Uruguay
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.72h figure and UI fine cap from general knowledge; DLA Piper confirms 'without undue delay'. Uruguay ratified Convention 108 and Protocol 223 (not re-verified).