Countries › Uruguay › Guide › 13. Regulation › Personal data protection in Uruguay

Personal data protection in Uruguay

Last verified: 2026-10-27 · Status: Stable

Ley 18.331 protects personal data of individuals and companies, requires prior informed consent unless an exception applies, and obliges private controllers to register their databases with the URCDP within 90 days of starting activity. Foreign businesses that offer goods or services to people in Uruguay or analyse their behaviour are covered, must apply privacy by design and impact assessments for risky processing, and must notify breaches to the URCDP within 72 hours. Uruguay holds an EU adequacy decision, so data can flow in from the EU; transfers out to countries without adequate protection need consent, a listed exception or URCDP authorization, with fines up to UI 500,000 (about US$83,000).

USD figures use UYU 40.210 per US dollar, the BCU quotation for DLS. USA BILLETE on 27 October 2026; amounts in Unidades Indexadas (UI) use UYU 6.6792 per UI, the BCU quotation for 27 October 2026, both retrieved from the BCU quotations service on 27 October 2026. Amounts in Unidades Reajustables (UR) use UYU 1,940.77 per UR, the value fixed by Decreto 229/026 (IMPO lists it as the latest UR, in force for September 2026). Conversions are rounded and for orientation only.

Key facts

Prior express consent required as main legal basis	Yes, with statutory exceptions Ley 18.331 art. 9, as of 2026-10-27 · in force
Deadline to answer a data access request	5 business daysLey 18.331 art. 14, as of 2026-10-27 · in force
Deadline to rectify, update or delete data	5 business daysLey 18.331 art. 15, as of 2026-10-27 · in force
Deadline to register a new private database	90 days from start of activityDecreto 414/009 art. 17, as of 2026-10-27 · in force
Deadline to notify the data protection officer	90 days from start of processingDecreto 64/020 art. 14, as of 2026-10-27 · in force
Deadline to start breach mitigation	24 hoursDecreto 64/020 art. 3, as of 2026-10-27 · in force
Data protection impact assessment required for high risk processing	Yes Decreto 64/020 art. 6, as of 2026-10-27 · in force
EU adequacy decision	Yes, Implementing Decision 2012/484/EU Decision 2012/484/EU, as of 2026-10-27 · in force
Data of companies protected	Yes Ley 18.331 art. 4 D, as of 2026-10-27 · in force
Maximum retention by processor after contract, with authorization	2 yearsLey 18.331 art. 30, as of 2026-10-27 · in force

The rule

1. Personal data means information of any kind about determined or determinable natural or legal persons, so company data is also protected. Sensitive data are data revealing racial and ethnic origin, political opinions, religious or moral convictions, trade union membership, health or sex life. Processing must follow the principles of legality, accuracy, purpose limitation, prior informed consent, security, confidentiality and accountability, and data must be deleted when no longer needed for the purposes for which they were collected.
Cost to do it: No fee; internal cost of a data inventory and retention schedule.
Example: A Montevideo B2B supplier's database of client companies and their contact persons is personal data under art. 4 D, not just the individuals. / A US SaaS provider processing Uruguayan corporate customers' data must apply the same principles even though the customers are companies.Ley Nº 18.331 (Personal Data Protection and Habeas Data), art. 4, 5 and 8, 2008-08-11 official text · verified 2026-10-27

2. Uruguayan law applies to controllers or processors established in Uruguay and, when not established there, if the processing relates to offering goods or services to inhabitants of Uruguay or to analysing their behaviour, if international law or a contract so provides, or if means located in Uruguay are used (except for mere transit, provided a representative domiciled in Uruguay is appointed).
Cost to do it: No fee; a foreign controller using Uruguayan equipment beyond transit needs a local representative.
Example: A Uruguayan subsidiary running a customer loyalty programme is covered as an established controller. / A US app that targets Uruguayan users with local pricing and tracks their behaviour is covered with no Uruguayan entity.Ley Nº 19.670, art. 37, art. 37, 2018-10-15 official text · verified 2026-10-27

3. Processing is lawful when the data subject has given free, prior, express and informed consent, which must be documented and, if given with other declarations, must appear expressly and prominently. Consent is not needed, among other cases, for data from public sources, data collected for state functions or under a legal obligation, basic lists of name, ID, nationality and address, and data arising from a contractual, scientific or professional relationship that are necessary for its performance. Before collecting data the controller must inform the purpose and recipients, the identity and address of the controller, whether answers are mandatory, the consequences of refusal, the rights of access, rectification and deletion, and whether there will be international transfers. Sensitive data may only be processed with express written consent, and nobody can be forced to provide them.
Cost to do it: No fee; cost of privacy notices and consent records.
Example: A gym that collects members' health data needs express written consent under art. 18. / A US marketing platform cannot rely on implied consent buried in terms of use; consent must be express and prominent.Ley Nº 18.331, art. 9, 13 and 18, 2008-08-11 official text · verified 2026-10-27

4. Data subjects have the right of access, free of charge at six month intervals, and the controller must answer within five business days. Rectification, update, inclusion or deletion requests must be handled within five business days, or the controller must explain why they do not apply. People may refuse decisions with significant legal effects based solely on automated evaluation of their personality, such as work performance, credit or reliability, and may ask for the criteria and programme used. If the controller does not comply in time, the person may bring a summary habeas data action before the courts.
Cost to do it: Internal process cost; litigation cost if a habeas data action is filed.
Example: A request received on Monday 2 November 2026 must be answered by Monday 9 November 2026. / A US lender scoring Uruguayan applicants automatically must be ready to explain the criteria if a decision is challenged under art. 16.Ley Nº 18.331, art. 14, 15, 16, 37 and 38, 2008-08-11 official text · verified 2026-10-27

5. Private individuals and companies that create, modify or delete personal databases must register them with the Registro de Bases de Datos Personales of the Unidad Reguladora y de Control de Datos Personales (URCDP). New databases must be registered within 90 days of starting activity. Registration covers the database and controller, how data are obtained and processed, security measures, rights procedures, recipients, retention period and access conditions. Registration is effective from the URCDP resolution, whose number and date must be displayed where users can see it, and changes must be reported quarterly.
Cost to do it: Ley 18.331 and Decreto 414/009 set no registration fee; cost is preparing the registration form for each database.
Example: A new Uruguayan subsidiary that starts operating on 1 December 2026 must register its HR and customer databases by 1 March 2027. / A US group's Uruguayan branch should register each database and display the URCDP resolution number on its website or premises.Ley Nº 18.331, art. 28 as reworded by Ley Nº 18.719 art. 152, and art. 29; Decreto Nº 414/009 art. 15, 16, 17, 19 and 20, Ley 18.331 art. 28 and 29; Decreto 414/009 art. 15 to 20, 2009-08-31 official text · verified 2026-10-27

6. Controllers and processors must take appropriate technical and organizational measures, including privacy by design, privacy by default and data protection impact assessments. An impact assessment must be done before processing starts where processing may involve sensitive data as a main business, stable processing of specially protected data or data on criminal, civil or administrative offences, or evaluation of personal aspects to create or use profiles, among other cases set in the regulation. It must contain at least a description of the processing, a compliance assessment, a risk assessment and the security measures.
Cost to do it: Cost of preparing and documenting the assessment, usually by the data protection officer or external counsel.
Example: A Uruguayan health app must complete an impact assessment before launch because sensitive data are its main business. / A US adtech firm profiling Uruguayan users should document an impact assessment before processing starts.Ley Nº 18.331, art. 12 as reworded by Ley Nº 19.670 art. 39; Decreto Nº 64/020 art. 5 to 9, Ley 18.331 art. 12; Decreto 64/020 art. 5 to 9, 2020-02-17 official text · verified 2026-10-27

7. Security breaches must be reported immediately and in detail to data subjects and to the URCDP, with the measures taken. Mitigation must start within the first 24 hours, and notice to the URCDP must be given within at most 72 hours of learning of the breach. Public entities, private entities whose main business is processing sensitive data and private entities processing large volumes of data (more than 35,000 people) must appoint a data protection officer with accredited legal knowledge of data protection, notify the URCDP within 90 days of starting processing, and give the officer full access and technical autonomy.
Cost to do it: Cost of an internal or external officer; entities with similar activities may share one (Decreto 64/020 art. 15).
Example: A Uruguayan retailer with 40,000 loyalty members exceeds the 35,000 threshold and must appoint and notify an officer. / If a US cloud provider used by a Uruguayan subsidiary is breached on a Friday, the URCDP must be notified by the following Monday.Ley Nº 19.670 art. 38 and 40; Decreto Nº 64/020 art. 3, 4, 10, 12, 13 and 14, Ley 19.670 art. 38 and 40; Decreto 64/020 art. 3 to 14, 2020-02-17 official text · verified 2026-10-27

8. Transfers of personal data to countries or international organizations that do not provide an adequate level of protection are prohibited, except, among others, for international judicial cooperation, medical data exchange, bank and stock exchange transfers, treaty arrangements, unequivocal consent of the data subject, transfers needed to perform a contract with the data subject, and transfers authorized by the URCDP when the exporter offers sufficient guarantees, which may come from appropriate contractual clauses. The exporter requests the authorization, identifying the registered database and the transfer and attaching any contract. For data coming in, the European Commission has found that Uruguay ensures an adequate level of protection for personal data transferred from the EU.
Cost to do it: No fee set; cost of contractual clauses and, where needed, a URCDP authorization request.
Example: A Uruguayan call centre sending customer data to a parent in a country without adequacy needs consent, a contract based exception or URCDP authorization. / An EU company can send employee data to its Uruguayan service centre under the EU adequacy decision without extra transfer tools.Ley Nº 18.331, art. 23; Decreto Nº 414/009 art. 34 and 35; Commission Implementing Decision 2012/484/EU of 21 August 2012, art. 1, Ley 18.331 art. 23; Decreto 414/009 art. 34 and 35, 2012-08-21 official text · verified 2026-10-27

9. The URCDP may impose, graded by seriousness, repetition or recidivism: observation, warning, a fine of up to UI 500,000, suspension of the database for five days, or closure of the database, which may be sought before the courts. Processors that handle data for third parties may not use them for other purposes or pass them on, and must destroy them at the end of the contract unless the controller expressly authorizes keeping them for up to two years for future work.
Cost to do it: Maximum fine UI 500,000 (about UYU 3,339,600, US$83,054) per sanction, plus suspension or closure.
Example: A processor that reuses a client's customer list for its own marketing breaches art. 30 and risks a fine up to UYU 3,339,600. / For a US company the fine ceiling is about US$83,054, but closure of a key database is the bigger operational risk.Ley Nº 18.331, art. 30 and 35, art. 30 and 35, 2008-08-11 official text · verified 2026-10-27

Obligation	Deadline	Source
Answer access request	5 business days	Ley 18.331 art. 14
Rectify or delete	5 business days	Ley 18.331 art. 15
Register new database	90 days from start of activity	Decreto 414/009 art. 17
Report changes to registration	Quarterly	Decreto 414/009 art. 20
Start breach mitigation	24 hours	Decreto 64/020 art. 3
Notify breach to URCDP	72 hours	Decreto 64/020 art. 4
Notify data protection officer	90 days from start of processing	Decreto 64/020 art. 14

Key deadlines

Sanction	Approx. UYU	Approx. USD
Observation or warning
Fine up to UI 500,000	3,339,600	83,054
Suspension of database	5 days
Closure of database	Through the courts

Sanctions (UYU and USD at the rates in the FX note)

Worked example

Market entry checklist: a foreign fintech launching in Uruguay on 1 December 2026 with 50,000 expected users must register its databases by 1 March 2027 (Decreto 414/009 art. 17), appoint a data protection officer and notify the URCDP by the same date (Decreto 64/020 art. 10 and 14), and run an impact assessment before launch if it profiles users for credit (Decreto 64/020 art. 6).
Fine exposure: the maximum fine of UI 500,000 equals about UYU 3,339,600 or US$83,054; because it is set in UI, the peso amount rises with inflation (Ley 18.331 art. 35).
Transfers: a Uruguayan subsidiary sending payroll data to a group HR platform hosted in a country without adequacy can rely on the employees' unequivocal consent or on URCDP authorization based on contractual clauses (Ley 18.331 art. 23; Decreto 414/009 art. 35).

Step by step

Map every personal database, including company and supplier data, and its legal basis.
Register each database with the URCDP within 90 days of starting activity and display the resolution number.
Update privacy notices to cover all art. 13 items, including international transfers.
Run impact assessments before high risk processing and document privacy by design and by default.
Appoint and notify a data protection officer if you process sensitive data as a main business or data of more than 35,000 people.
Set up a breach plan: mitigation within 24 hours, URCDP notice within 72 hours, and notice to affected people.
Document international transfers: adequacy, consent, contract necessity or URCDP authorization.

Common traps

Uruguay protects data of legal persons, not only individuals, unlike many other regimes.
Database registration is a standing obligation, and changes must be reported quarterly.
Access and rectification deadlines are five business days, much shorter than the one month common elsewhere.
Foreign companies targeting Uruguayan residents are covered even without a local entity.
Processors must destroy data at the end of the contract unless expressly authorized to keep them, for at most two years.
Sensitive data require express written consent; checkbox consent buried in terms will not do.

Sources

← Cartels and abuse of dominance in UruguayAnti money laundering duties in Uruguay →