Uruguay

Uruguay's data protection regime is anchored in Law No. 18.331 of 11 August 2008 (the LPD/Habeas Data Act), regulated by Decree No. 414/009 of 31 August 2009, and substantially reformed by Law No. 19.670 of 15 October 2018 (introducing accountability, DPO, breach notification and privacy-by-design/default), with implementing detail added by Decree No. 64/020 of 21 February 2020. The supervisory authority is the Unidad Reguladora y de Control de Datos Personales (URCDP), a decentralized body operating within the orbit of AGESIC. The regime covers personal data of both natural and legal persons processed in public- or private-sector databases, excluding purely personal/household processing and databases serving public security, defence or state-security purposes. Extraterritorial application attaches where a controller/processor carries out a stable activity in Uruguay.

The LPD's 2008 text already incorporated EU-style consent standards, and the 2018/2020 reforms layered on accountability-driven controls around sensitive data and de-identification. Search coverage located strong evidence on DPO thresholds tied to sensitive-data processing and on URCDP/AGESIC anonymisation guidance, but did not surface a fully enumerated lawful-bases catalogue or granular consent-validity thresholds equivalent to GDPR Art 6/7 text for this pass — these remain to be pulled directly from the LPD's Spanish-language articles (arts. 5, 9, 18) for full confidence.

Uruguay grants a right of access to explicit and unambiguous information on the destination and purpose of stored personal data, plus rights to correction, updating, deletion, inclusion or suppression where data is erroneous or false. Enforcement of these rights follows a two-step model: a prejudicial petition to the controller, followed by a judicial Habeas Data action, without prejudice to URCDP's advisory/oversight role. No explicit, GDPR-Art-20-style portability right was identified for the 2008-era statute in this pass, and statutory response-deadline windows were not independently re-confirmed.

The 2018 reform (Law 19.670) introduced an accountability/proactive-responsibility principle requiring controllers and processors to adopt, document, periodically review and evaluate the effectiveness of security and confidentiality measures, alongside DPIA obligations. DPO designation must be communicated to URCDP within 90 days of the start of processing, with statutory requirements on legal expertise and confidentiality. Breach notification follows a tight timeline: impact minimisation within 24 hours and URCDP notification within a maximum of 72 hours, with no quantitative minimum threshold, plus subject notification where the breach has a 'significant' effect on rights. Joint-controller arrangements and granular retention/disposal rules were not independently confirmed in this pass.

Uruguay is the only Latin American jurisdiction to hold an EU adequacy decision (Commission Implementing Decision 2012/484/EU, under the former Directive 95/46/EC framework, still in effect). Domestically, Article 23 of the LPD prohibits transfers to non-adequate countries/organisations absent sufficient guarantees, which the URCDP may accept in the form of appropriate contractual clauses; URCDP Resolution 41/2021 provides model-clause guidance, and Resolution 23/2021 sets the country adequacy list (referencing Ibero-American standards and the EU GDPR) and addresses post-Schrems II US transfers. Decree 64/020 imposes a transfer impact assessment requirement for non-adequate destinations. URCDP Resolution 63/2023 extended recognised adequacy to South Korea and EU-US Data Privacy Framework-certified entities. No mandatory data-localisation regime was identified.

No sector-specific overlays (banking secrecy, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) displacing or supplementing the general LPD regime were independently confirmed for Uruguay within this research pass. Uruguay is known to have separate banking-secrecy legislation and consumer-credit-reporting practices, but verified statutory citations tying these to data-protection-specific carve-outs were not retrieved.

No dedicated cookie/tracker consent regime, dark-pattern prohibition, opt-out signal recognition, clean-room rule, cross-context-advertising rule, or direct-marketing-specific suppression regime was independently confirmed for Uruguay in this research pass. General LPD consent and purpose-limitation principles would apply to commercial/marketing processing, but no adtech-specific instrument was located.

The LPD carves databases serving public-security, defence or state-security purposes out of its general scope, which functions as a state-surveillance carve-out subject to any specific regulating law. No Uruguay-specific profiling restriction, ADM-transparency right, AI-specific risk-assessment regime, biometric-specific statute, or genetic-data-specific regime was independently confirmed in this research pass.

No Uruguay-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-settings-specific DP rules, or dependent-adult protections were independently confirmed in this research pass. Comparators from Spain (age 14 consent threshold under LOPDGDD) were located but are not applicable to the bound UY JID and are excluded per JID discipline.

URCDP holds a graduated sanctioning power ranging from observations and warnings through database closure and fines, set out in implementing decree provisions. Data subjects retain a private right of action via the judicial Habeas Data proceeding in addition to URCDP complaints. URCDP has been an active guidance-issuing body (de-identification guide 2017, SCC guidance 2021, adequacy resolutions 2021/2023), though a quantified 12-month enforcement/fines activity index, regulator funding/headcount figures, a collective-redress/class-action mechanism, and confirmed developments within the last 180 days were not located in this research pass.