Provides telecom services, in Uruguay

Ley N° 18.331, de 11 de agosto de 2008, arts. 9-11, 17, 20, 22, 24 y 29 · Read the law's page

• Obtain the data subject's free, prior, express, and informed consent, documented in writing, before processing their personal data, unless a listed exception applies (data from public sources, a legal mandate, a state function, or a contractual, scientific, or professional relationship).
• Communicate personal data to a third party only for a purpose directly tied to the sender's and recipient's legitimate interest, only with the data subject's prior consent, and only after telling them the purpose of the communication and identifying the recipient.
• Adopt the security and confidentiality measures needed to prevent unauthorized alteration, loss, consultation, or processing of personal data, and store it so the data subject can exercise their right of access.
• Register any database of personal data you create, modify, or eliminate with the Unidad Reguladora y de Control de Datos Personales before operating it, and hold only the categories of data you declared in that registration.
• Keep a negative record of a natural person's unpaid commercial obligation registered for no more than five years from its entry, renewable once for another five years if the debt remains unpaid, and update the record within days of being notified the debt was settled.
• If you operate a public communications network or offer an electronic communications service, secure the network and the service, and tell subscribers about any particular risk of a security breach and the measures to take.

Decreto N° 66/025, arts. 10(g) y 12 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Communicate the occurrence of a cybersecurity incident to CERTuy within 24 hours of becoming aware of it, in the form and conditions CERTuy sets (article 10(g)).
• Report the existence of a potential cybersecurity incident fully and immediately, under the criteria CERTuy sets (article 12(a)).
• Make available to CERTuy, and to the sector CSIRT where there is one, all the information they request, within the times they ask (article 12(b)).
• Repair the consequences of incidents that affect critical information assets, in accordance with the recommendations you are given (article 12(c)).

Decreto N° 66/025, arts. 10, 11, 14 a 18 y 21 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Adopt effective security measures to protect your critical information assets, following the guidelines AGESIC sets (article 10(a)).
• Designate an information security officer, who may be internal or external to the entity (article 10(c)).
• Keep centralized audit traces of your information systems for no less than twelve months, or the period CERTuy determines (article 11(a)).
• Adopt the Marco de Ciberseguridad AGESIC developed and meet the minimum maturity level assigned to your profile (article 14).
• Carry out audits under the Marco de Ciberseguridad at the periodicity AGESIC defines (article 16), send AGESIC an executive summary within 30 calendar days of finishing each audit, and send a compliance action plan within 60 calendar days of finishing the external audit where improvements are needed (article 17).
• Guarantee that the services you outsource to meet your tasks comply with the Marco de Ciberseguridad (article 18).