🇺🇾
Uruguay
Personal Data Protection Law No. 18,331
Americas🔵 Substantial
Compliance Score
43%
6 Addressed
7 Partial
1 None
Authority
Regulatory and Control Unit of Personal Data (URCDP)
Overview
Uruguay's Law No. 18,331 establishes rights and duties for personal-data processing and is complemented by implementing regulations. The URCDP supervises compliance; verify current rules and international-transfer requirements for the specific use case.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
PartialDPO Requirements
PartialChildren's Data
PartialPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
PartialAI & Automated Decisions
PartialData Localisation
PartialSignificant Data Fiduciary
NoneGovernment Data
Addressed? Frequently Asked Questions
What is the primary data protection law in Uruguay?+
Uruguay is governed by the Personal Data Protection Law No. 18,331. The law is enforced by the Regulatory and Control Unit of Personal Data (URCDP). According to our analysis, the country has a Substantial level of data protection framework.
Does Uruguay require a Data Protection Officer (DPO)?+
Partially. The Personal Data Protection Law No. 18,331 may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Uruguay?+
Partially. While Personal Data Protection Law No. 18,331 may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Uruguay?+
The Personal Data Protection Law No. 18,331 has limited breach notification requirements. It may only require notifying the regulator, without mandating notification to affected individuals.