Uruguay Recording Laws: One-Party Consent, Penalties, and 2024 Cybercrime Updates

Quick Answer: Uruguay Is One-Party Consent

Uruguay does not have a single recording consent statute. The legality of recording conversations emerges from the intersection of constitutional protections, criminal code provisions, and the absence of any law prohibiting participant recording. That gap, read alongside Article 10 of the Constitution, produces a one-party consent framework.

If you are a participant in the conversation, you may record it. The other person's consent is not required. This applies to phone calls, in-person meetings, video calls, and messaging apps with audio functionality.

The line is interception. Recording a conversation you are not part of is a criminal offense under Article 297 of the Código Penal. That distinction, participant versus eavesdropper, is the foundation of Uruguay's recording law.

For organizations and employers, the data protection regime administered by the Unidad Reguladora y de Control de Datos Personales (URCDP) adds a second, parallel layer of regulation beyond the criminal code.

Constitutional Foundation: Articles 10, 28, and 72

Three provisions of the Uruguayan Constitution shape how courts and scholars analyze recording disputes.

Article 28 declares that the papers of private persons and their correspondence, whether epistolary, telegraphic, or of any other kind, are inviolable. They may never be searched, examined, or intercepted except in conformity with laws enacted for reasons of public interest. This provision establishes the constitutional baseline for communications privacy.

Article 10 states that private actions of persons that do not harm public order and do not injure a third party fall outside the authority of magistrates. Uruguayan legal scholars have cited this article as the constitutional anchor for one-party consent: when a participant records their own conversation, that is a private action causing no injury to the other party, and no law prohibits it.

Article 72 provides that the enumeration of rights, duties, and guarantees in the Constitution does not exclude others inherent to the human personality or derived from the republican form of government. Courts have relied on this article to recognize privacy rights that the text does not spell out explicitly, including the right to control one's own image and voice.

Together, these three provisions create a framework in which privacy is constitutionally protected but participant recording remains constitutionally permitted.

Código Penal: Articles 296 Through 300

The criminal code provisions governing recording and communications interception are contained in Ley 9.155, Uruguay's Código Penal, in the chapter dealing with offenses against correspondence and communications.

Article 296: Violation of Written Correspondence

Article 296 criminalizes opening sealed correspondence not addressed to you with intent to learn its contents. The penalty is a fine of 20 to 400 Unidades Reajustables (UR). An aggravated version applies when someone intercepts, destroys, or conceals mail to steal its contents or disrupt service, carrying one to four years imprisonment. Public officials who commit these offenses face enhanced penalties.

While Article 296 targets written correspondence rather than audio recordings, it establishes the foundational legal principle that intercepting communications belonging to others constitutes a crime.

Article 297: Interception of Telephone and Telegraph Communications

Article 297 is the provision most directly relevant to recording law. It criminalizes the use of artificial means ("medios artificiosos") to intercept, prevent, or interrupt telegraphic or telephone communications.

The penalty is a fine of 20 to 400 UR. At current values (approximately 1,852 Uruguayan pesos per UR as of 2026), that translates to roughly USD 850 to USD 17,000.

The key word is "intercept." Uruguayan legal doctrine holds that a participant who records their own conversation does not intercept anything. They capture words directed at them. Interception requires a third party inserting themselves into a communication channel without authorization from any participant.

Article 298: Unauthorized Disclosure of Communication Secrets

Article 298 penalizes the unauthorized revelation of the contents of correspondence or telephonic communications. Two distinct offenses exist: sharing with others what was learned through interception, and publishing correspondence that by its nature should remain secret.

The penalty is a fine of 20 to 200 UR. Critically, the statute contains a "justa causa" (just cause) exception. Disclosure is not criminal when just cause exists, which has been interpreted to include presenting evidence in judicial proceedings, reporting criminal activity, and whistleblowing on corruption in the public interest.

Article 299 and 300: Fraudulent Access and Aggravated Offenses

Article 299 addresses fraudulent access to documents and secret correspondence in professional or commercial contexts. Article 300 covers aggravated forms of offenses in Articles 296 through 299 when committed by telecommunications professionals or public employees who exploit their position.

Article 298 was last amended by Ley 15.903 in 1987. The core framework of Articles 296 through 300 has remained structurally stable since Uruguay's Código Penal was enacted in 1933.

Ley 20327 (2024): Uruguay's First Cybercrime Law

On September 25, 2024, Uruguay enacted Ley 20327, the country's first dedicated cybercrime legislation. The law added several new articles to the Código Penal with direct relevance to digital recording and interception.

Article 297 BIS: Illicit Access to Digital Data

Article 297 BIS criminalizes unauthorized access to, interference with, dissemination, sale, or transfer of another person's information stored in digital media, where that access is obtained through computer or telematic means without authorization and without just cause. The penalty is 6 to 24 months imprisonment.

This provision extends Uruguay's interception framework into cloud storage, messaging apps, and digital file systems, closing a gap that the original 1933 Código Penal language could not fully address.

Article 297 TER: Illicit Interception of Computer Transmissions

Article 297 TER targets the interception, interruption, or interference with computer data in non-public transmissions directed at a computer system, whether those transmissions originate from within a system or include electromagnetic emissions carrying data.

The penalty is also 6 to 24 months imprisonment. The phrase "non-public transmissions" is significant: it confirms that the prohibition tracks the same participant/eavesdropper logic as Article 297. Public broadcasts and openly accessible data are not covered. Private digital communications, including VoIP calls, encrypted messaging, and internal network traffic, are protected.

Significance for Recording Law

Ley 20327 did not change the one-party consent rule. A participant in a digital conversation may still record it. What changed is that third-party interception of digital communications now carries imprisonment rather than a fine, substantially increasing the criminal exposure for unauthorized recording of phone apps, video calls, and encrypted messaging services.

Ley 18.331 and the URCDP: Data Protection Framework

Ley 18.331, enacted August 11, 2008, is Uruguay's comprehensive personal data protection law. Audio and video recordings of identifiable individuals constitute personal data under the law.

Core Principles

Article 5 establishes seven principles: legality, veracity, purpose limitation, prior consent, data security, confidentiality, and accountability. Any organization recording individuals must have a lawful basis, collect only what a stated purpose requires, and protect recordings from unauthorized access.

Consent Requirements

Article 9 requires free, prior, explicit, and documented consent before personal data is processed. Exceptions exist for data from public sources, data required by law, limited identifying information in professional contexts, and data arising from contractual relationships.

For organizational audio recording, this means businesses generally need consent to record people unless a statutory exception applies. Individual participants recording their own private conversations fall under Article 10 of the Constitution rather than the organizational consent framework of Ley 18.331.

Sensitive Data

Article 18 provides heightened protections for sensitive data, including information revealing racial or ethnic origin, political opinions, religious beliefs, health status, and sexual life. Audio recordings capturing this type of information trigger additional consent requirements and enhanced security obligations.

Sanctions

Article 35 grants the URCDP authority to impose graduated sanctions:

• Observation (formal notice of a violation)
• Warning (formal admonition)
• Fine of up to 500,000 Unidades Indexadas (UI), approximately USD 65,000
• Database suspension for up to five business days
• Database closure (permanent shutdown of the offending data operation)

These sanctions apply to unauthorized recording, failure to register databases, inadequate security measures, and failure to honor data subject access rights.

Recent Updates and EU Adequacy Reconfirmation

Uruguay was the first Latin American country to receive an EU adequacy decision, in August 2012. That decision confirms that personal data transferred from the EU to Uruguay receives protection equivalent to GDPR standards.

On January 15, 2024, the European Commission completed a review of eleven existing adequacy decisions and reconfirmed Uruguay's status. The Commission specifically noted Uruguay's amendments to Ley 18.331 that introduced accountability requirements, including data protection impact assessments, data protection by design and default, 72-hour data breach notification obligations, data protection officer (DPO) appointments for high-risk processing, and expanded territorial scope.

Uruguay remains on the URCDP's list of countries to which data may be transferred freely. EU-originating personal data captured in recordings may be transferred to Uruguay, and Uruguayan data may be transferred to EU member states, without additional authorization.

URCDP's Role

The URCDP is Uruguay's independent data protection authority. It publishes binding resolutions, receives database registrations, investigates complaints, and enforces sanctions under Ley 18.331. The URCDP also produces sector-specific guidance, including the workplace surveillance resolution discussed below.

Ley 19.293: Judicial Wiretapping and Law Enforcement

Ley 19.293, Uruguay's Code of Criminal Procedure enacted in 2014, governs state interception of private communications.

Authorization Requirements

Article 208 establishes the framework for judicial authorization. A prosecutor must petition a judge, presenting sufficient evidence that a crime has been or is likely to be committed. The judge must issue a reasoned decision that explicitly weighs the necessity and proportionality of the surveillance against the individual's rights.

Failure to properly reason the decision renders the authorization null. Any evidence obtained under a void authorization is excluded.

Duration Limits

Initial authorization periods run up to six months. Extensions of up to two years total are permitted for complex investigations or cases involving criminal organizations.

Protected Communications

Communications between a suspect and their defense attorney cannot be intercepted unless the judge finds evidence that the attorney may bear criminal responsibility in the same matter.

El Guardian Surveillance System

In 2014, the government deployed a centralized surveillance platform called "El Guardian," capable of simultaneously monitoring up to 800 mobile phones, 200 fixed lines, and multiple email and social media accounts. The system consolidated more than 22 separate interception tools previously used by different agencies.

Civil liberties organizations have raised concerns about oversight gaps, including the absence of mandatory notification to surveillance targets after investigations conclude and unclear data retention timelines for intercepted material that is not used in proceedings.

Suprema Corte de Justicia: Jurisprudential Context

Uruguay follows the civil law tradition. Court decisions do not carry binding stare decisis effect on other cases. Doctrine and legal scholarship play a more prominent role in shaping interpretation than in common law systems.

The Suprema Corte de Justicia (SCJ) is Uruguay's highest court for constitutional and civil matters. It has recognized privacy as a fundamental right under Article 72 of the Constitution, and its decisions on data protection and communications privacy generally reinforce the principles codified in Ley 18.331 and the Código Penal.

The Ache-Bustillo Case (2023)

The most significant modern application of Uruguay's recording consent framework came during the Caso Marset political scandal in late 2023. Carolina Ache, who served as Vice Foreign Minister, recorded conversations with Foreign Minister Francisco Bustillo without his knowledge. The recordings captured Bustillo allegedly instructing Ache to destroy her phone containing WhatsApp messages about the issuance of a Uruguayan passport to accused drug trafficker Sebastián Marset. Ache turned the recordings over to prosecutors, and they were subsequently published.

Bustillo resigned in November 2023.

Alejandro Abal, former dean of the Faculty of Law at the Universidad de la República and a specialist in procedural law, analyzed the recordings publicly. He concluded they "no constituyen delito" (do not constitute a crime). His reasoning: Ache was a participant in the conversations, so Article 297 did not apply. The recordings were admissible because they were offered by a party to the dialogue. On disclosure, he concluded that "justa causa" existed because the recordings documented potential obstruction of justice and public corruption.

The Ache-Bustillo matter illustrates how the participant/eavesdropper framework operates in practice: participant recording is treated as lawful, and disclosure may be justified when the public interest warrants it.

Phone Calls

Recording a phone call in Uruguay is legal when you are one of the parties on the call. No notification is required.

This rule applies to calls on landlines, mobile phones, and internet-based voice services. The legal basis is the absence of any statutory prohibition on participant recording, combined with the constitutional freedom of private action under Article 10.

Third-party interception of phone calls is a criminal offense under Article 297. The 2024 cybercrime law (Ley 20327) extends this prohibition to VoIP calls, encrypted messaging with voice functions, and other digital communication platforms through Articles 297 BIS and 297 TER. The penalties for digital interception (6 to 24 months imprisonment) are substantially higher than those for the original Article 297 (20 to 400 UR fine).

If you record a phone call in which you participate and later share that recording, Article 298's "justa causa" exception becomes relevant. Publishing a recording of a private matter with no public interest dimension may constitute an offense under Article 298. Publishing a recording to report a crime or expose corruption is more likely to fall within the exception.

In-Person Conversations

Uruguay's one-party consent principle applies fully to face-to-face conversations. A participant may record without informing others present.

No Uruguayan statute separately addresses in-person recording apart from the telephone interception framework. Legal scholars apply the same constitutional analysis: Article 10 exempts private actions that cause no harm, and no law prohibits a participant from recording their own conversation.

Practical implications: meetings, negotiations, and personal discussions may be recorded by any participant. The location, whether a private home, office, restaurant, or public space, does not change the analysis for participant recording.

The Article 298 disclosure restriction still applies after recording. Sharing the recording publicly where the conversation was of a confidential nature may constitute an offense absent just cause.

Recording Police and Public Officials

Recording police officers performing their duties in public is legal in Uruguay.

There is no prohibition on filming or recording police procedures from a reasonable distance, provided you do not obstruct the officers or interfere with the scene. Human rights organization SERPAJ has confirmed that every citizen has the right to film a police procedure. Authorities may not confiscate recordings, demand deletion, or seize phones to prevent documentation of police conduct without a judicial order.

The Law of Urgent Consideration (LUC), enacted in 2020, did not modify or restrict this right. Claims by police officers that the LUC prohibits recording are not legally valid; no article in that law establishes such a prohibition.

Experts recommend live-streaming video of police encounters through social media platforms as an additional safeguard, creating an automatic off-device copy in the event authorities attempt to seize or delete recordings.

Recording officials in private settings, such as a meeting between a citizen and an official on a non-public matter, follows the same one-party consent rule: if you are a participant in the conversation, you may record it.

Workplace Recording and Employer Surveillance

The URCDP has issued binding guidance on employer surveillance through Resolution 58/021, which consolidates regulatory criteria for handling images and audio captured through workplace surveillance systems.

Audio Recording Prohibition

The URCDP workplace surveillance guidance explicitly states that "no deben registrarse conversaciones privadas" (private conversations must not be recorded). Employers cannot deploy audio surveillance systems to capture employee conversations. Video cameras with audio capabilities may be installed in work areas, but the audio recording function must not capture conversations.

Video Surveillance Requirements

Employers who install video cameras must satisfy these requirements before operation:

• Employees must receive written advance notice before cameras are installed
• The specific locations of all cameras must be disclosed to employees
• Whether cameras capture image only or image and audio must be disclosed
• The data retention period must be communicated
• Employees must be informed how to exercise their data protection rights

Prohibited Locations

Cameras are categorically prohibited in bathrooms, changing rooms, rest areas, dining spaces, and locations where union activities take place.

Database Registration

All video surveillance systems must be registered with the URCDP as personal data databases under Ley 18.331 before they begin operating. Running an unregistered surveillance system is itself a violation triggering sanctions.

Access Controls

The physical recording system must be located in a restricted-access area. Only specifically authorized personnel may access recorded footage or audio.

Voyeurism and Non-Consensual Intimate Images

Uruguay does not have a standalone voyeurism statute in the Código Penal equivalent to those found in some common law jurisdictions. Non-consensual recording and distribution of intimate images is addressed through a combination of frameworks.

Ley 19.580: Gender-Based Violence

Ley 19.580, enacted December 22, 2017, addresses violence against women based on gender. The law recognizes "violencia mediática" (media violence) and "violencia sexual" (sexual violence) as forms of prohibited gender-based violence. Recording or capturing intimate images of a person without consent, or distributing such images, falls within these categories when committed in a context of gender-based harm.

The law establishes prevention, protection, and reparation mechanisms. Violations can result in criminal referral under existing Código Penal provisions combined with civil remedies.

Ley 18.331 Data Protection

Recording intimate images of an identifiable person without consent constitutes unauthorized processing of personal data under Ley 18.331. The URCDP can impose fines and order database closure. This administrative pathway operates independently of any criminal prosecution.

Existing Criminal Framework

Beyond Ley 19.580, non-consensual recording and distribution of intimate images may be prosecuted under Article 297 (interception), Article 298 (unauthorized disclosure), and general provisions on offenses against personal honor and dignity in the Código Penal.

As of mid-2025, Uruguay has not enacted a dedicated non-consensual intimate image (NCII) statute. Legislative attention to this area is growing across Latin America, with Uruguay monitoring regional developments including Mexico's Ley Olimpia, which criminalizes digital violence and has been cited as a model for other countries in the region.

Deepfakes and AI-Generated Content

Uruguay has not enacted legislation specifically targeting deepfakes or AI-generated synthetic media as of 2025.

The gap is covered, imperfectly, by existing frameworks. Ley 20327 (2024) creates criminal liability for unauthorized manipulation and dissemination of digitally stored information under Article 297 BIS. Generating and distributing a realistic deepfake of another person without consent could constitute unauthorized interference with that person's digital information or fraudulent data misuse depending on the facts.

Ley 18.331 provides a data protection pathway: a realistic deepfake of an identifiable person constitutes processing of that person's biometric likeness. Processing biometric data without consent violates the sensitive data provisions under Article 18. The URCDP could pursue sanctions against individuals or organizations that create or distribute non-consensual deepfakes.

Ley 19.580 provides a gender-based violence pathway where deepfake pornography targets women or is used in a context of intimate partner abuse.

Uruguay's parliament has been tracking international legislative developments on deepfakes, including the EU AI Act's provisions prohibiting services that generate non-consensual sexual synthetic images. No dedicated bill had been enacted into law as of May 2025. Organizations and individuals operating in Uruguay who produce AI-generated media depicting real people should monitor legislative developments, as the regulatory environment is actively evolving across the region.

Cross-Border Recordings

Recordings that involve participants in different countries raise questions about which jurisdiction's law applies.

General Conflict of Laws Principle

Uruguayan courts generally apply the law of the place where the offense is committed or the place where its effects are principally felt. For a phone or video call between a person in Uruguay and a person abroad, Uruguayan recording law applies to the conduct of the participant located in Uruguay.

EU Adequacy and Data Transfers

Because Uruguay holds EU adequacy status (reconfirmed January 2024), recordings of EU data subjects made in Uruguay and transferred back to the EU do not require additional authorization under GDPR. The transfer is treated as equivalent to an intra-EU transfer.

For transfers to jurisdictions without adequacy recognition, Ley 18.331 requires that the receiving country or organization demonstrate an adequate level of data protection. The URCDP's list of adequate countries includes all EU member states, Argentina, Canada, Japan, New Zealand, Switzerland, the United Kingdom, South Korea, and, for commercial transfers, US entities that have adhered to the EU-US Data Privacy Framework and extended those safeguards to Uruguayan data.

Practical Guidance for Multinational Operations

A multinational that records customer service calls in Uruguay must comply with Ley 18.331 consent and database registration requirements. If those recordings are stored in a US data center, the US entity must have adhered to an adequate transfer mechanism. Recordings of EU-based customers are additionally governed by GDPR on the EU side of the transfer.

Law Enforcement Requests

Foreign law enforcement requests for communications interception data held in Uruguay must proceed through judicial assistance channels. The judge authorizing a wiretap under Ley 19.293 retains authority over the scope of any disclosure to foreign authorities. Direct requests from foreign agencies to telecommunications providers without judicial authorization are not lawful under Uruguayan procedure.

Penalties Reference

Criminal Penalties Under the Código Penal

Offense	Article	Penalty
Opening sealed correspondence	Art. 296	Fine of 20-400 UR
Intercepting or destroying mail (aggravated)	Art. 296	1-4 years imprisonment
Intercepting telephone or telegraph communications	Art. 297	Fine of 20-400 UR
Unauthorized disclosure of communication secrets	Art. 298	Fine of 20-200 UR
Fraudulent access to secret documents	Art. 300	Fine of 20-400 UR
Illicit access to digital data	Art. 297 BIS (Ley 20327)	6-24 months imprisonment
Illicit interception of computer transmissions	Art. 297 TER (Ley 20327)	6-24 months imprisonment

The Unidad Reajustable (UR) is an inflation-indexed unit. As of early 2026, one UR is valued at approximately 1,852 Uruguayan pesos (roughly USD 42).

Data Protection Penalties Under Ley 18.331

Sanction	Description
Observation	Formal notice of violation
Warning	Formal admonition
Fine	Up to 500,000 UI (approx. USD 65,000)
Suspension	Database shutdown for up to 5 business days
Closure	Permanent database shutdown

Civil Liability

Individuals whose privacy has been violated through unauthorized recording may bring civil claims for damages under general tort principles and the civil personality rights framework of the Código Civil. Civil claims operate independently of criminal and administrative proceedings.

Civil Law: Personality Rights

Uruguay's Código Civil recognizes personality rights as attributes of the person that are inseparable from the individual and enjoy special legal protection. These include the right to one's own image, the right to honor, and the right to privacy.

A person whose voice or image is recorded without consent and then published may pursue a civil action for damages on the basis of personality rights infringement, even where the recording itself was not a criminal offense. For example, a participant recording that was subsequently disclosed publicly without just cause could give rise to a civil claim even if no criminal prosecution is brought.

Civil courts can order injunctions to prevent publication or further distribution of recordings, as well as compensatory and moral damages. Civil claims are independent of criminal proceedings and do not require a prior criminal conviction.

This page provides general legal information about Uruguay recording laws and is not legal advice. Laws change; consult a qualified Uruguayan attorney for advice specific to your situation.