§ Compliance · Updated 2026-10-20
Data protection in Uruguay: Law 18,331 and Decree 64/020.
Law 18,331 protects personal data in the public and private sectors. Law 19,670 and Decree 64/020 added key obligations: notify breaches within 72 hours, appoint a data protection officer and assess the impact of certain processing.
At a glance
- Main law
- Law 18,331 (2008)
- Key changes
- Law 19,670, arts. 37–40 (2018)
- Regulation
- Decree 64/020 (2020)
- Breach notification
- 72 hours to URCDP
- Authority
- URCDP (Personal Data Regulatory and Control Unit)
Who it applies to
Personal data recorded on any medium, in both the public and private sectors (Law 18,331, art. 3). Since Law 19,670 it also covers controllers without an establishment in Uruguay when they offer goods or services to its residents or analyze their behavior (art. 37).
Private databases must be registered with the URCDP (art. 28).
What it requires
- Respect the principles of legality, accuracy, purpose, informed consent, security, confidentiality and accountability (art. 5).
- When a security breach occurs, start measures to minimize its impact within 24 hours of confirming it (Decree 64/020, art. 3).
- Notify the breach to the URCDP within a maximum of 72 hours of becoming aware of it, and inform data subjects in plain language when it significantly affects their rights (art. 4).
- Appoint a data protection officer if you are a public entity, a private entity with state participation, process sensitive data as your core business or process large volumes (more than 35,000 people), and notify the URCDP within 90 days (Law 19,670, art. 40; Decree 64/020, arts. 10 and 14).
- Carry out an impact assessment before processing sensitive data as a core business, profiling or processing large volumes of data, among other cases (arts. 6 and 7).
- Apply privacy by design and by default (arts. 8 and 9).
Sanctions
The URCDP can issue an observation, a warning, a fine of up to 500,000 indexed units (UI), a 5-day suspension of the database or request its closure in court, depending on severity and repetition (Law 18,331, art. 35).
If you are also a critical entity
Deadlines add up: an incident affecting personal data at an entity covered by Decree 66/025 is reported to CERTuy within 24 hours and to the URCDP within 72 hours. They are two independent obligations.
Uruguay holds a European Union adequacy decision (Decision 2012/484/EU), confirmed in the European Commission's January 2024 review.
⏱ Deadlines and frequencies
| Deadline | What | Rule |
|---|---|---|
| 24 hours | Start measures to minimize the impact of a breach | Decree 64/020, art. 3 |
| 72 hours | Notify the breach to the URCDP | Decree 64/020, art. 4 |
| 90 days | Notify the appointment of the data protection officer | Decree 64/020, art. 14 |
→ How I help
- Compliance assessment: databases, purposes, consents and security measures.
- Breach management and notification procedure within 72 hours.
- Impact assessments and privacy by design in new systems, including AI.
- Technical and security support for the data protection officer.
? FAQ
How quickly must a personal data breach be notified in Uruguay?
To the URCDP within a maximum of 72 hours of becoming aware of it (Decree 64/020, art. 4). Measures to minimize the impact must start within 24 hours.
Does my company need a data protection officer?
Yes, if it is a public entity or a private entity with state participation, if it processes sensitive data as its core business, or if it processes data of more than 35,000 people.
Does the law apply to foreign companies?
Yes, if they offer goods or services to residents of Uruguay or analyze their behavior, even without an establishment in the country (Law 19,670, art. 37).
Official sources
- Law 18,331 (IMPO) ↗
- Law 19,670, arts. 37–40 (IMPO) ↗
- Decree 64/020 (IMPO) ↗
- URCDP: regulations ↗
- EU adequacy decision 2012/484/EU ↗
General information, verified against official sources on the date shown. It does not replace legal advice for your case.
Other regulations