Uruguay: technology regulation at a glance

Framework: Law No. 20,345 of 19 September 2024 (Virtual Assets Act); BCU/SSF PSAV Regulatory Project (August 2025, revised March 2026); administered by Banco Central del Uruguay (BCU), Superintendencia de Servicios Financieros (SSF)

Uruguay enacted Law No. 20,345 on 19 September 2024, establishing the BCU/SSF as the licensing and supervisory authority for Virtual Asset Service Providers (PSAVs) and legalising crypto activity nationwide. The BCU published a comprehensive PSAV regulatory project in August 2025 and released a revised second public consultation in March 2026; as of May 2026 the secondary rules have not yet been promulgated in final form. Existing operators have until 31 December 2026 to file authorisation requests and until 30 June 2027 to achieve full compliance, placing Uruguay in an active transition toward a regulated crypto market.

Framework: National AI Strategy 2024-2030 (AGESIC); draft AI regulation bill in development; Council of Europe AI Framework Convention (CETS No. 225) signed September 2025

Uruguay has no comprehensive AI law in force as of mid-2026. The government, through AGESIC, approved a National Artificial Intelligence Strategy 2024-2030 in November 2024 and is actively drafting a standalone AI regulation bill. Uruguay became the first Latin American country to sign the Council of Europe's legally binding Framework Convention on Artificial Intelligence in September 2025, while a December 2025 executive decree established regulatory sandboxes for AI and data projects.

Framework: Ley N° 18.331 (Protección de Datos Personales y Acción de Habeas Data, 2008), as amended by Ley N° 19.670 (2018) and regulated by Decreto N° 64/020 (2020); supervised by the Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC.

Uruguay has an in-force, comprehensive, GDPR-style data protection regime built on Ley N° 18.331 of 11 August 2008, which protects personal data in both the public and private sectors and grants individuals access, rectification, deletion and habeas data rights. The law has been strengthened by Ley N° 19.670 (2018) and Decreto N° 64/020 (2020), adding proactive accountability, mandatory data protection officers and breach-notification duties. Enforcement sits with the independent supervisory authority URCDP, and the EU has recognized Uruguay as providing an adequate level of protection (2012, confirmed in 2024).

Framework: Ley 19.210 de Inclusión Financiera (2014) and BCU Recopilación de Normas de Sistema de Pagos (RNSP); supervised by Banco Central del Uruguay (BCU) / Superintendencia de Servicios Financieros (SSF)

Uruguay has a well-established, multi-category licensing framework for digital payments and fintech, anchored in the 2014 Financial Inclusion Law and operationalized through the BCU's Recopilación de Normas de Sistema de Pagos (RNSP). The BCU/SSF issues distinct licenses for electronic money issuers (IEDE), payment service providers and collectors (PSPC), and payment instrument acquirers. A real-time interbank payment rail has been live since May 2021, while open banking and a formal regulatory sandbox remain proposed under the BCU's Payment System Roadmap 2026-2030 and a draft sandbox law forwarded to the Executive Branch in 2026.

Framework: Decreto 238/022; Ley de Migración No. 19.254 (2014); administered by Dirección Nacional de Migración, Ministerio del Interior

Uruguay launched a dedicated Digital Nomad Permit ('Identidad Provisoria Nómada Digital') in May 2023 under Decreto 238/022, granting remote workers a 180-day legal stay renewable once for up to 12 months total. The application is fully online via the official liveinuruguay.uy portal at a cost of approximately USD 11. Uruguay's territorial tax system means foreign-sourced income is generally exempt from Uruguayan personal income tax for non-tax-resident permit holders.

Framework: Law No. 20.327 (Cybercrime, 2024); Law No. 18.331 (Data Protection, 2008/updated 2019); no comprehensive online-safety or platform-liability law in force

Uruguay has partial online-safety rules: a 2024 cybercrime statute criminalises online harassment, fraud and unauthorised access, and a GDPR-aligned data-protection law provides baseline privacy rights. However, no comprehensive online-safety regime (equivalent to the EU DSA or UK OSA) exists; platform intermediary liability is uncodified, age-verification requirements are absent, and a parliamentary proposal to democratically regulate large digital platforms received by the Senate in late 2025 had not been enacted as of mid-2026.

Framework: Decree 66/025 (February 2025) + AGESIC Cybersecurity Framework (MCU) + Law 20,327 on Cybercrime (August 2024) + National Cybersecurity Strategy 2024-2030, administered by AGESIC/CERTuy with sector-specific oversight by BCU and URSEC

Uruguay operates a layered cybersecurity regime anchored by Decree 66/025 (enacted February 20, 2025), which mandates compliance with the AGESIC Cybersecurity Framework for all public entities and private operators of critical services, and by Law 20,327 (August 23, 2024), which codified cybercrime offences aligned with the Budapest Convention. The overarching strategic direction is set by the National Cybersecurity Strategy 2024-2030, approved by the Honorary Advisory Council on Information Security (CAHSI) in December 2024. No single comprehensive cybersecurity act equivalent to NIS2 exists; the regime is instead built from a presidential decree, a criminal-law statute, and sector regulators.

Framework: Ley 16.060 (Ley de Sociedades Comerciales); Ley 19.820/2019 (Sociedad por Acciones Simplificada, SAS); Dirección General Impositiva (DGI); Registro Nacional de Comercio (Auditoría Interna de la Nación, AIN); Banco de Previsión Social (BPS); Uruguay XXI (official investment promotion agency)

Uruguay is one of Latin America's most open and straightforward jurisdictions for business formation by foreigners. Foreign investors may own 100% of a Uruguayan company with no prior authorization required and may choose from several entity types, including the fully digital SAS (introduced by Ley 19.820/2019) which carries no statutory minimum capital. The standard process, notarized bylaws, registration with the Registro Nacional de Comercio, and enrollment with DGI and BPS, is typically completed in 15-30 business days, with accelerated digital pathways available for the SAS.