Uruguay Personal Data Protection Law — Law No. 18.331

Why does it matter?

Law No. 18.331 is enforced by a regulator with inspection powers and by the courts. The URCDP can observe, warn, fine up to 500,000 Unidades Indexadas, suspend a database for five days or seek its closure (Art. 35), and any person can bring a habeas data action that must be heard within three days of filing, with judgment in the hearing or within 24 hours (Arts. 41 and 43). Since January 1, 2019 the law has also reached companies with no establishment in Uruguay that offer goods or services to its residents or analyze their behavior (Law No. 19.670, Art. 37), and the EU adequacy decision for Uruguay rests on the law being applied as written.

Key benefits include:

• A constitutional right with a court remedy

Art. 1 places data protection among the rights implicit in Article 72 of the Constitution, and Arts. 37 to 45 give every data subject a summary habeas data action against any public or private database.

• Seven named principles

Art. 5 lists legality, veracity, purpose, prior informed consent, data security, confidentiality and responsibility, and makes them the rule for interpreting the rest of the law.

• Fixed response clocks

Access must be answered within five business days (Art. 14), rectification, update, inclusion or deletion within five business days (Art. 15), and the Art. 13 notice supplied within five business days when data were not collected from the person.

• Accountability duties since 2019

Art. 12, as rewritten by Law No. 19.670, requires privacy by design, privacy by default and data protection impact assessments, which Decree 64/020 turns into documented, periodically reviewed measures available to the URCDP on request.

• Recognized adequacy

The European Commission lists Uruguay among the countries with an adequacy decision (2012/484/EU) and confirmed in its January 15, 2024 report on the first review of the eleven decisions adopted under Directive 95/46/EC that they remain in place.

How does it work?

Art. 3 applies the law to personal data recorded on any medium capable of processing, and to every later use of them, in the public or private sector, excluding databases kept by natural persons for exclusively personal or domestic activities, databases for public security, defense, state security and criminal investigation, and databases created and regulated by special laws. Art. 4 defines the terms: personal data covers identified or identifiable natural and legal persons; sensitive data means racial and ethnic origin, political preferences, religious or moral convictions, union membership and information on health or sexual life; consent must be free, unequivocal, specific and informed; the controller decides the purpose, content and use of processing; the processor acts on its behalf.

Under Art. 37 of Law No. 19.670 a controller or processor not established in Uruguay is bound when it offers goods or services to residents, analyzes their behavior or uses means located in the country; Decree 64/020 (Arts. 1 and 2) requires such entities to register their databases with the URCDP. Chapter II sets the operating rules: a database is lawful when registered (Art. 6); data must be accurate, not excessive and deleted when no longer needed (Arts. 7 and 8); processing requires documented consent that is free, prior, express and informed, unless the data come from public sources, a legal obligation, a limited identification list, or a contractual, scientific or professional relationship (Art. 9).

Art. 10 obliges the controller or user to adopt measures that guarantee security and confidentiality and forbids recording personal data in databases that lack technical conditions of integrity and security; Art. 11 imposes professional secrecy. Art. 13 lists what a person must be told before collection: the purpose and recipients, the controller's identity and address, whether answers are mandatory, the rights in Arts. 14 to 16, whether international transfers take place and, for automated processing, the evaluation criteria and the program used. Art. 16 gives the right not to be subject to a decision with significant legal effects based solely on automated processing, and Art. 17 limits communication of data to third parties.

Art. 18 allows sensitive data to be processed only with express written consent or under a law of general interest, Art. 18-BIS requires an impact assessment before biometric data are processed, and Art. 22 caps the retention of personal credit-default data at five years, renewable once. Art. 23 prohibits transfers to countries or international organizations that do not provide adequate protection, lists the exceptions (judicial cooperation, medical exchanges, banking and stock transactions, treaties, intelligence cooperation, unequivocal consent, contract performance, important public interest, vital interest and public registers) and lets the URCDP authorize a transfer when the controller offers sufficient guarantees, which may come from contractual clauses.

Public and private databases must be entered in the register kept by the URCDP with the particulars in Art. 29, from the nature of the data to the recipients and retention period; a processor may use the data only for the contracted purpose and must destroy them when the service ends, keeping them at most two years with express authorization (Art. 30). The URCDP is a decentralized organ of AGESIC with full technical autonomy, led by a three-member council (Arts. 31 and 32); Art. 34 gives it the power to issue rules, keep the register, inspect premises and records, require documents and set criteria for automated processing, and Art. 35 lists the sanctions.

Decree 64/020 adds the breach procedure (containment within 24 hours, notice to the URCDP within 72 hours of knowledge, plain-language notice to significantly affected data subjects and a final report, Arts. 3 and 4), the triggers and minimum content of an impact assessment (Arts. 6 and 7), privacy by design and by default (Arts. 8 and 9) and the data protection officer, mandatory for public entities, private entities whose main business is sensitive data and any entity processing data on more than 35,000 people, to be notified to the URCDP within 90 days (Arts. 10 to 14). Decree 414/009 (Arts. 15 to 20) regulates the register itself: what is filed, when, and the duty to keep the entry current.

Key Elements

• Principles (Art. 5)

Legality, veracity, purpose, prior informed consent, data security, confidentiality and responsibility bind every public or private controller and everyone who handles third-party personal data, and serve as the interpretive rule for the whole law.

• Consent and information (Arts. 9 and 13)

Consent is free, prior, express, informed and documented, with the exceptions in Art. 9; the Art. 13 notice names the purpose, recipients, controller, consequences of refusal, the rights available, any international transfer and, for automated processing, the criteria and program used.

• Data subject rights and habeas data (Arts. 14 to 17 and 37 to 45)

Free access at six-month intervals and answers within five business days; rectification, update, inclusion or deletion within five business days; the right to challenge automated evaluations; and a summary court action with a hearing within three days and compliance ordered within 15 calendar days.

• Specially protected data (Arts. 18 to 22)

Sensitive data only with express written consent or statutory authority; biometric data after an impact assessment (Art. 18-BIS); health data under professional secrecy; telecommunications operators' security duties; advertising databases with a free opt-out; credit-default data for five years, renewable once.

• International transfers (Art. 23)

No transfers to countries or organizations without an adequate level of protection, except in the listed cases, or with URCDP authorization backed by sufficient guarantees such as contractual clauses.

• Accountability, breaches and the DPO (Art. 12; Law No. 19.670 Arts. 38 and 40; Decree 64/020)

Privacy by design and by default, documented impact assessments, breach notification to the URCDP within 72 hours with coordination through CERTuy, and a technically autonomous data protection officer for public bodies, sensitive-data businesses and large-volume processors.

What does it cover?

The law applies to any personal data, including data on legal persons, recorded on any medium that makes processing possible, and to every later use of those data by the public or private sector (Arts. 2 and 3). It binds controllers, processors and users established in Uruguay and, since January 1, 2019, those abroad whose processing targets residents of Uruguay, analyzes their behavior or uses means located in the country (Law No. 19.670, Art. 37). It does not apply to personal or domestic databases, to public security, defense, state security and criminal databases, or to databases regulated by special laws (Art. 3); armed forces, police and intelligence databases stay within the law for administratively stored data (Art. 25).

What are its objectives?

The law states its purpose in Art. 1 and in the principles of Art. 5; its operative provisions pursue five outcomes.

Protect the right to personal data protection as a right inherent to the human person under Article 72 of the Constitution, extended to legal persons where applicable (Arts. 1 and 2).

Make processing lawful only when databases are registered and operated under the seven principles of Art. 5, with documented prior informed consent as the default basis (Arts. 6 and 9).

Give data subjects enforceable rights of information, access, rectification, update, inclusion and deletion within five business days, and a summary habeas data action when those rights are refused (Arts. 13 to 15 and 37 to 45).

Keep personal data secure and confidential, with proactive accountability measures, breach notification and a data protection officer where the amendments of Law No. 19.670 and Decree 64/020 require them (Arts. 10 to 12).

Control cross-border flows through the adequacy test and URCDP authorization in Art. 23, and supervise the whole regime through a technically autonomous regulator with inspection and sanctioning powers (Arts. 31 to 35).

Framework in Context

Law No. 18.331 sits in the European tradition of data protection law: Decree 414/009 cites Directive 95/46/EC as its model, Uruguay approved Council of Europe Convention 108 and its Additional Protocol by Law No. 19.030 of December 27, 2012 and signed the modernization protocol on October 10, 2018, and Decree 64/020 states that it drew on the GDPR, the Ibero-American data protection standards and Convention 108. The European Commission lists Uruguay among the third countries with an adequacy decision, reviewed in its report of January 15, 2024. Decree 64/020 (Art. 3) points controllers to AGESIC's Cybersecurity Framework, and URCDP Resolution No. 8/026 of April 17, 2026 recommends the Council of Europe's model contractual clauses for transfers under Art. 23.

Common Framework Mappings

Organizations map Law No. 18.331 to the privacy frameworks below so that one register of processing, one consent record and one rights-request workflow satisfy the URCDP and the regulators of the other jurisdictions they serve.

Mapped frameworks include:

APEC PF

Argentina PDPL (Law 25.326)

LGPD

Convention 108+

GDPR

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines