# Cybersecurity regulation in Uruguay.

> Plain-text version for machine reading (LLMs). Original page: https://damian.dearce.com.uy/en/compliance/

What Law 20,212, Decree 66/025, Law 18,331, the Central Bank (BCU) and ISO/IEC 27001 require, who they apply to and within what deadlines. Explained plainly, with a link to every official source.

- [AGESIC Cybersecurity Framework: Law 20,212 and Decree 66/025](https://damian.dearce.com.uy/en/compliance/marco-ciberseguridad-agesic/index.html.md): What Uruguay's Law 20,212, Decree 66/025 and AGESIC Cybersecurity Framework 5.0 require: scope, 24-hour incident reporting to CERTuy, security officer and audits.
- [Uruguay's data protection Law 18,331: obligations and deadlines](https://damian.dearce.com.uy/en/compliance/proteccion-de-datos-ley-18331/index.html.md): Uruguay's Law 18,331, Law 19,670 and Decree 64/020: 72-hour breach notification, data protection officer, impact assessments and URCDP sanctions.
- [BCU cybersecurity requirements for financial entities in Uruguay](https://damian.dearce.com.uy/en/compliance/bcu-sistema-financiero/index.html.md): Uruguay Central Bank (BCU) cybersecurity rules: Minimum Management Standards, monthly scans, pentesting, SIEM, incident reporting and Circular 2497.
- [ISO 27001 in Uruguay: what it is, controls and certification](https://damian.dearce.com.uy/en/compliance/iso-27001/index.html.md): ISO/IEC 27001:2022 in Uruguay and Latin America: the 93 Annex A controls, the end of the 2013 version, the two-stage certification and how to prepare.

## If there is an incident, who and when?

| Report to | Deadline | Who must report | Rule |
|---|---|---|---|
| CERTuy | 24 hours | Public entities and private entities in critical sectors | Decree 66/025, art. 10 |
| URCDP | 72 hours | Personal data controllers and processors, when data is affected | Decree 64/020, art. 4 |
| BCU (payment system) | 4 hours | Acquirers, processors, e-money issuers and others | Communication 2024/018 |
| BCU (SSF) | As soon as possible | Entities supervised by the Financial Services Superintendency | Communication 2021/105 |

These obligations are independent: a single incident may require several reports in parallel.

_General information, verified against official sources on the date shown. It does not replace legal advice for your case. Updated: 2026-10-20._

## Contact

- WhatsApp: +598 99 231 327 (https://wa.me/59899231327)
- Email: damian.de.arce@gmail.com
- LinkedIn: https://www.linkedin.com/in/damiandearce/