Processes personal data, in Uruguay

Ley N° 18.331, art. 23 (transferencia internacional de datos personales) · Read the law's page

• Transfer personal data outside Uruguay only to a country or organization that provides an adequate level of protection under international or regional legal standards, unless one of the law's listed exceptions applies (judicial cooperation, medical necessity, banking or stock-exchange transactions, an applicable treaty, or law-enforcement intelligence cooperation).
• Absent an adequate-protection finding, transfer personal data internationally only with the data subject's unambiguous consent, under a contractual-necessity exception, or after the Unidad Reguladora y de Control de Datos Personales authorizes the transfer based on the contractual safeguards you offer.

Ley N° 18.331, de 11 de agosto de 2008, arts. 9-11, 17, 20, 22, 24 y 29 · Read the law's page

• Obtain the data subject's free, prior, express, and informed consent, documented in writing, before processing their personal data, unless a listed exception applies (data from public sources, a legal mandate, a state function, or a contractual, scientific, or professional relationship).
• Communicate personal data to a third party only for a purpose directly tied to the sender's and recipient's legitimate interest, only with the data subject's prior consent, and only after telling them the purpose of the communication and identifying the recipient.
• Adopt the security and confidentiality measures needed to prevent unauthorized alteration, loss, consultation, or processing of personal data, and store it so the data subject can exercise their right of access.
• Register any database of personal data you create, modify, or eliminate with the Unidad Reguladora y de Control de Datos Personales before operating it, and hold only the categories of data you declared in that registration.
• Keep a negative record of a natural person's unpaid commercial obligation registered for no more than five years from its entry, renewable once for another five years if the debt remains unpaid, and update the record within days of being notified the debt was settled.
• If you operate a public communications network or offer an electronic communications service, secure the network and the service, and tell subscribers about any particular risk of a security breach and the measures to take.

Ley N° 18.331, de 2008, arts. 4 (literal E), 18 y 19 (datos sensibles y datos relativos a la salud) · Read the law's page

• Do not require anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life), and process what you do collect only with the data subject's express written consent.
• Collect and process sensitive data absent that consent only where an interest-general law authorizes it, the requesting body has a legal mandate to do so, or the purpose is statistical or scientific and the data is disassociated from its subject.
• Do not build a database whose content directly or indirectly reveals sensitive data, unless you are a political party, union, church, or other nonprofit body processing only your own members' sensitive data for your own political, religious, or similarly aligned purpose, and even then never communicate it further without the member's consent.
• If you are a health establishment or a health professional, collect and process a patient's physical or mental health data only under the rules of professional secrecy and the applicable health-sector regulations.

Ley N° 19.670, de 15 de octubre de 2018, art. 38, reglamentado por Decreto N° 64/020, de 2020 (notificación de vulneración de seguridad) · Read the law's page

• Notify the affected data subjects immediately and in detail on becoming aware of the breach, describing the measures adopted to address it.
• Notify the Unidad Reguladora y de Control de Datos Personales immediately and in detail on becoming aware of the breach, coordinating your response with the national cybersecurity incident response center (CERTuy).

Ley N° 19.670, de 15 de octubre de 2018, arts. 37, 39 y 40 (Ley N° 18.331, art. 12) · Read the law's page

• Adopt privacy-by-design, privacy-by-default, and data-protection impact assessment measures as part of a proactive-accountability duty, and be able to demonstrate their effective implementation.
• If established outside Uruguay, treat processing that offers goods or services to people in Uruguay, analyzes their behavior, or uses means located in Uruguay as subject to Ley N° 18.331.
• If a public entity, a wholly or partly state-owned entity, or a private entity that processes sensitive data as a main line of business or processes large volumes of data, designate a data-protection officer with technical autonomy.

Decreto N° 64/020, de 17 de febrero de 2020, art. 4 (comunicación de vulneraciones de seguridad) · Read the law's page

• As controller, once you establish that a security breach affecting data protection has occurred, communicate it to the Unidad Reguladora y de Control de Datos Personales within a maximum of 72 hours of becoming aware of the breach, with the relevant information, such as the certain or estimated date of the breach, its nature, the personal data affected and the possible impacts.
• As processor, tell the controller immediately when you learn of a breach.
• As controller, tell the data subjects who suffered a significant effect on their rights, in clear and simple language.
• Once the breach is resolved, prepare a detailed report of the breach and the measures adopted, and send it to the Unidad Reguladora y de Control de Datos Personales.

Ley N° 18.331, arts. 13-15 y 21, según Ley N° 20.075, de 2022, y Ley N° 18.719, de 2010 (derechos de los titulares de los datos) · Read the law's page

• Before or when you collect personal data, tell the data subject expressly, precisely, and unambiguously the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, the consequences of refusing or of inaccuracy, their rights of access, rectification, and challenge, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.
• Give a data subject free access, at most every six months, to all information about them held in your database, supplied within five business days, in clear language, covering the whole record without revealing a third party's data.
• Correct, update, include, or delete a data subject's personal data within five business days of their request when it is erroneous, false, or missing, or explain why it does not, and notify any recipient of the data of the correction within five business days.
• On request, remove or block a data subject's data from a marketing, canvassing, or profiling database at any time, and give the data subject access to the data you hold in such a database free of charge.

Ley N° 18.331, arts. 31-36 y 37-45 (órgano de control, potestades sancionatorias y acción de habeas data) · Read the law's page

• Expect the Unidad Reguladora y de Control de Datos Personales to inspect your books, documents, and files, physical or electronic, demand your appearance to provide information, and, in serious cases, seize materials for up to six business days.
• Expect graduated administrative sanctions when you violate the law: observation, warning, a fine of up to UI 500,000 (Unidades Indexadas, an inflation-linked accounting unit), a five-day suspension, or closure of the database.
• Expect any person to be able to bring an effective habeas data judicial action against you to learn what personal data about them you hold, its purpose and use, and to demand its rectification, inclusion, suppression, or another appropriate remedy where the data is erroneous, false, prohibited from processing, discriminatory, or outdated.