Uruguay
ComprehensiveLaw No. 18,331 on the Protection of Personal Data
Authority: Unidad Reguladora y de Control de Datos Personales (URCDP) | Enforcement: Active | Enacted: August 2008
Overview
Uruguay was the first Latin American country to receive EU adequacy (2012). The URCDP actively enforces compliance. The law provides comprehensive data protection with GDPR-aligned principles, data subject rights, and cross-border transfer rules.
14-Topic Coverage
Data Protection Authority
Fully AddressedURCDP oversees compliance, handles complaints, and registers databases.
Consent Requirements
Fully AddressedFree, prior, express, and informed consent required.
Data Subject Rights
Fully AddressedRights to access, rectification, updating, inclusion, suppression, and habeas data action.
Cross-Border Transfer
Fully AddressedTransfers to adequate countries. Uruguay has EU adequacy status.
Breach Notification
Partially AddressedNo explicit statutory breach notification. URCDP guidance developing.
DPO Requirements
Partially AddressedMust register databases. No formal DPO role.
Children's Data
Partially AddressedGeneral provisions apply. Protections for children and adolescents.
Penalties & Enforcement
Fully AddressedFines, database suspension, or closure. Active enforcement by URCDP.
Sector-Specific Rules
Fully AddressedBCU financial data rules, health data regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Fully AddressedLaw applies to both public and private sector.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Uruguay's regulations.
Book a Consultation