Skip to content
World Watch

Data protection & privacy law in Uruguay (2026)

Data protection in Uruguay: comprehensive law.

Uruguay has an in-force, comprehensive, GDPR-style data protection regime built on Ley N° 18.331 of 11 August 2008, which protects personal data in both the public and private sectors and grants individuals access, rectification, deletion and habeas data rights. The law has been strengthened by Ley N° 19.670 (2018) and Decreto N° 64/020 (2020), adding proactive accountability, mandatory data protection officers and breach-notification duties. Enforcement sits with the independent supervisory authority URCDP, and the EU has recognized Uruguay as providing an adequate level of protection (2012, confirmed in 2024).

Last verified Official sources first · MethodologyCompare Uruguay with other countries

Legal framework

Ley N° 18.331 (Protección de Datos Personales y Acción de Habeas Data, 2008), as amended by Ley N° 19.670 (2018) and regulated by Decreto N° 64/020 (2020); supervised by the Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC.

Key points: data & privacy in Uruguay

  1. Comprehensive in-force law

    Ley N° 18.331 (enacted 11 Aug 2008) regulates the processing of personal data across public and private sectors, anchored in the constitutional right to data protection (art. 72 of the Constitution); it is fully in force, not pending.

    impo.com.uy agesic.gub.uy

  2. Supervisory authority (URCDP)

    The Unidad Reguladora y de Control de Datos Personales, a body with technical autonomy operating under AGESIC, oversees compliance, maintains the mandatory database registry, investigates complaints, conducts inspections and imposes sanctions.

    gub.uy

  3. GDPR-style 2018-2020 reforms

    Ley N° 19.670 (2018, arts. 37-40) and its regulation Decreto N° 64/020 (21 Feb 2020) introduced extraterritorial scope, proactive accountability (responsabilidad proactiva), mandatory data protection officers (delegado de protección de datos), and security-breach notification obligations.

    impo.com.uy iapp.org

  4. Database registration & data-subject rights

    Controllers must register databases containing personal data with the URCDP, and data subjects hold rights of access, rectification, updating, inclusion and deletion, enforceable through the habeas data judicial action set out in the law.

    impo.com.uy seleccion.poderjudicial.gub.uy

  5. International transfer restrictions

    Art. 23 of Ley N° 18.331 prohibits transfers to countries lacking adequate protection unless an exception applies (e.g. prior, express and informed consent of the data subject) or URCDP authorization is obtained.

    oas.org

  6. Sanctions regime

    The URCDP can apply graduated sanctions ranging from observations and warnings to fines (up to 500,000 indexed units / Unidades Indexadas) and suspension or judicial closure of non-compliant databases.

    impo.com.uy iapp.org

  7. EU adequacy recognition

    The European Commission granted Uruguay an adequacy decision in 2012 (the second Latin American country to obtain one) and reaffirmed it in its January 2024 review of pre-GDPR adequacy decisions.

    eur-lex.europa.eu

Sources

  1. impo.com.uy/bases/leyes/18331-2008
  2. agesic.gub.uy/innovaportal/v/302/1/agesic/ley-n%C2%B0-18331-de-11-de-agosto-de-2008
  3. gub.uy/unidad-reguladora-control-datos-personales/sites/unidad-reguladora-co
  4. impo.com.uy/bases/decretos/64-2020
  5. seleccion.poderjudicial.gub.uy/seleccion/archivos/ley18331habeasdata2008.pdf
  6. oas.org/es/sla/ddi/docs/U4%20Ley%2018.331%20de%20Protecci%C3%B3n%20de%20Datos
  7. eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52024DC0007
  8. iapp.org/news/a/uruguay-dicta-nuevas-normas-sobre-proteccion-de-datos
  9. impo.com.uy/bases/leyes/18331-2008/35

Next for Uruguay: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026