§ Compliance
Cybersecurity regulation in Uruguay.
What Law 20,212, Decree 66/025, Law 18,331, the Central Bank (BCU) and ISO/IEC 27001 require, who they apply to and within what deadlines. Explained plainly, with a link to every official source.
- 01Cybersecurity Framework (AGESIC)What Uruguay's Law 20,212, Decree 66/025 and AGESIC Cybersecurity Framework 5.0 require: scope, 24-hour incident reporting to CERTuy, security officer and audits.
- 02Data protection (Law 18,331)Uruguay's Law 18,331, Law 19,670 and Decree 64/020: 72-hour breach notification, data protection officer, impact assessments and URCDP sanctions.
- 03BCU: financial sectorUruguay Central Bank (BCU) cybersecurity rules: Minimum Management Standards, monthly scans, pentesting, SIEM, incident reporting and Circular 2497.
- 04ISO/IEC 27001ISO/IEC 27001:2022 in Uruguay and Latin America: the 93 Annex A controls, the end of the 2013 version, the two-stage certification and how to prepare.
! Incident reporting deadlines
If there is an incident, who and when?
| Report to | Deadline | Who must report | Rule |
|---|---|---|---|
| CERTuy | 24 hours | Public entities and private entities in critical sectors | Decree 66/025, art. 10 |
| URCDP | 72 hours | Personal data controllers and processors, when data is affected | Decree 64/020, art. 4 |
| BCU (payment system) | 4 hours | Acquirers, processors, e-money issuers and others | Communication 2024/018 |
| BCU (SSF) | As soon as possible | Entities supervised by the Financial Services Superintendency | Communication 2021/105 |
These obligations are independent: a single incident may require several reports in parallel.
General information, verified against official sources on the date shown. It does not replace legal advice for your case. Updated: 2026-10-20.