Uruguay Data Privacy Laws: Law 18.331 and EU Adequacy Guide (2026)

Overview of Uruguay's Data Protection Framework

Uruguay has established itself as a leader in data protection in Latin America. The country's Personal Data Protection Law (Ley de Proteccion de Datos Personales), Law No. 18.331, was enacted on 11 August 2008 and entered into force on 18 August 2008. The law was subsequently supplemented by Regulatory Decree 414/009 of 2009, which provides detailed implementing rules.

The framework draws inspiration from European data protection standards and was designed from the outset to meet international benchmarks. This strategic approach bore fruit in 2012 when the European Commission adopted an adequacy decision recognizing Uruguay as providing an adequate level of data protection, enabling the free flow of personal data from the EU to Uruguay.

Uruguay's data protection framework is grounded in the country's constitutional order. While the Constitution does not contain an explicit data protection right, Article 72 of the Constitution is interpreted broadly to encompass the right to personal data protection as an inherent right derived from the human personality. The Constitution also provides for the habeas data action, allowing individuals to access, correct, or delete their personal data held by public and private entities.

Law 18.331: Core Provisions

Scope and Application

Law 18.331 applies to all personal data recorded in any medium that allows processing, including collection, storage, organization, conservation, modification, retrieval, consultation, use, dissemination, blocking, or destruction. The law covers both automated and non-automated processing and applies to public and private sector entities alike.

The law applies to data processing carried out in Uruguayan territory. It also applies to controllers established outside Uruguay when they use means (automated or otherwise) located in Uruguay for processing, unless those means are used solely for transit purposes.

Definition of Personal Data

Personal data is defined as information of any kind relating to an identified or identifiable natural person. The law recognizes a category of especially protected data (datos especialmente protegidos), which includes sensitive data such as data revealing racial or ethnic origin, political opinions, religious or moral beliefs, trade union affiliation, and information relating to health or sexual life.

Principles of Data Processing

The law establishes several core principles governing data processing. The principle of legality requires that databases and data processing comply with the law. The principle of accuracy requires that data be accurate and updated as necessary. The principle of purpose requires that data be collected for specific, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

Additional principles include the principle of prior consent (requiring consent before processing), the principle of security (requiring appropriate measures to protect data), the principle of confidentiality (requiring those involved in processing to maintain confidentiality), and the principle of accountability (requiring controllers to be responsible for compliance).

Consent Requirements

Consent is the default legal basis for the processing of personal data under Law 18.331. Consent must be free, express, and informed. The data subject must be clearly informed about the purpose of the processing before providing consent. Consent may be revoked at any time, though revocation does not have retroactive effect.

The law provides exemptions from the consent requirement in certain circumstances, including data obtained from publicly accessible sources, data collected for the exercise of state functions, data that consists only of names and addresses collected for direct marketing purposes (subject to the right to object), and data necessary for a contractual relationship.

Sensitive Data

The processing of sensitive data is subject to heightened requirements. As a general rule, no person may be compelled to provide sensitive data. Processing of sensitive data requires the express and written consent of the data subject, unless specific exemptions apply, such as processing necessary for statistical or scientific purposes (with anonymization), processing by religious or political organizations relating to their members, or processing for health purposes by medical professionals.

Data Subject Rights

Law 18.331 grants data subjects the following rights: the right to information (to be told when data is collected and the purposes of processing), the right of access (to obtain a copy of personal data and information about processing), the right to rectification (to correct inaccurate or incomplete data), the right to deletion (to request the removal of data that is no longer necessary or was processed unlawfully), the right to object (to oppose the processing of data in certain circumstances), and the right to data portability (introduced through subsequent regulatory developments).

Data controllers must respond to access requests within five business days.

The URCDP: Uruguay's Supervisory Authority

Establishment and Independence

The Regulatory and Control Unit for Personal Data (Unidad Reguladora y de Control de Datos Personales, URCDP) was established by Law 18.331 as the supervisory authority for data protection in Uruguay. The URCDP operates with technical autonomy and is responsible for overseeing compliance with the law, receiving and investigating complaints, and taking enforcement action.

The authority is governed by a board of three members appointed by the Executive Branch, with the Senate's consent, for a four-year term. This appointment structure provides a measure of independence while maintaining democratic accountability.

Powers and Functions

The URCDP has broad regulatory and enforcement powers. These include the power to advise and issue opinions on data protection matters, to maintain the National Registry of Databases, to receive and investigate complaints from data subjects, to conduct inspections and audits of data controllers and processors, to impose administrative sanctions for violations, to promote awareness of data protection rights, and to cooperate with international data protection authorities.

Enforcement Actions

The URCDP has a range of enforcement tools at its disposal. For violations of Law 18.331, the authority may issue warnings, impose administrative fines, order the suspension of database operations, and request judicial closure of databases. The graduated nature of these sanctions allows the URCDP to tailor its response to the severity of the violation.

The authority has been active in enforcement, particularly in areas such as unauthorized direct marketing, inadequate security measures, and failures to comply with data subject access requests.

Database Registration

Mandatory Registration Requirement

One of the most distinctive features of Uruguay's data protection framework is the mandatory registration of all databases containing personal data with the URCDP. This requirement applies to both public and private sector entities and must be completed before data processing begins.

The registration must include the name and details of the database, the identity of the data controller, the purposes of the processing, the categories of personal data contained in the database, the categories of data subjects, the security measures in place, and the source of the data.

National Registry

The URCDP maintains the National Registry of Databases (Registro Nacional de Bases de Datos), which is publicly accessible and serves as a transparency mechanism. Data subjects can consult the registry to identify which organizations hold their personal data, facilitating the exercise of their rights.

Failure to register a database is a sanctionable offense and may result in administrative fines and corrective orders.

Cross-Border Data Transfers

EU Adequacy Decision

Uruguay's EU adequacy decision, adopted by the European Commission on 21 August 2012, recognizes that the country provides an adequate level of data protection for the purposes of personal data transfers from the EU. This decision enables personal data to flow freely from EU Member States to Uruguay without the need for additional safeguards such as standard contractual clauses or binding corporate rules.

The adequacy decision was based on an assessment of Uruguay's legal framework, the URCDP's enforcement capabilities, and the effective exercise of data subject rights. Uruguay is one of only a few countries in Latin America to hold this status, alongside Argentina.

Transfer Restrictions

Law 18.331 restricts international transfers of personal data to countries or international organizations that provide adequate levels of data protection. The URCDP has the authority to determine which jurisdictions meet this standard.

Where the receiving country does not provide adequate protection, transfers may proceed under specific circumstances, including with the express consent of the data subject, transfers necessary for the performance of a contract, transfers necessary for international judicial cooperation, and transfers necessary for the protection of public interest.

Contractual Safeguards

Transfers to non-adequate countries may also proceed when the data controller provides adequate contractual guarantees. The URCDP has developed standard contractual clauses that may be used for this purpose.

Penalties and Sanctions

Administrative Penalties

Law 18.331 provides for administrative penalties for violations. The URCDP may impose fines, with the amount determined based on the nature and severity of the violation, the number of data subjects affected, the economic capacity of the violator, and any history of prior violations.

Progressive Enforcement

The URCDP employs a graduated enforcement approach. Initial violations may be addressed through warnings and recommendations. Continued or serious violations result in administrative fines. Persistent non-compliance may lead to the suspension of database operations, and in extreme cases, the URCDP may seek judicial closure of the database.

Habeas Data Action

In addition to administrative enforcement, individuals may pursue a habeas data action through the courts. This constitutional remedy allows data subjects to obtain judicial orders for access to, correction of, or deletion of their personal data. The habeas data action provides a powerful judicial enforcement mechanism that complements the URCDP's administrative powers.

Practical Compliance Considerations

Organizations operating in Uruguay or processing data of Uruguayan residents should ensure compliance with Law 18.331 and its implementing regulations. Key steps include registering all personal data databases with the URCDP before commencing processing, implementing appropriate consent mechanisms that meet the law's requirements, establishing procedures for responding to data subject requests within the five-day timeframe, reviewing cross-border data transfer practices and implementing appropriate safeguards, and appointing personnel responsible for data protection compliance.

Uruguay's EU adequacy status is an important asset for the country's business environment, facilitating data flows with European partners and clients. Organizations that maintain compliance with Uruguay's framework benefit from this facilitated data transfer relationship.

The URCDP regularly publishes guidance, opinions, and recommendations on its website, providing organizations with practical support for compliance. Organizations should monitor these publications for updates and new interpretive guidance.

This article is for informational purposes only and does not constitute legal advice. Data protection laws are subject to change, and organizations should consult with a qualified attorney for advice specific to their situation.