UruguayDecreto N° 64/020, personal data breach communication
Decreto N° 64/020, de 17 de febrero de 2020, art. 4 (comunicación de vulneraciones de seguridad)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- As controller, once you establish that a security breach affecting data protection has occurred, communicate it to the Unidad Reguladora y de Control de Datos Personales within a maximum of 72 hours of becoming aware of the breach, with the relevant information, such as the certain or estimated date of the breach, its nature, the personal data affected and the possible impacts.
- As processor, tell the controller immediately when you learn of a breach.
- As controller, tell the data subjects who suffered a significant effect on their rights, in clear and simple language.
- Once the breach is resolved, prepare a detailed report of the breach and the measures adopted, and send it to the Unidad Reguladora y de Control de Datos Personales.
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 4 of Decreto N° 64/020 requires the controller, once it establishes that a security breach affecting data protection has occurred, to communicate it to the Unidad Reguladora y de Control de Datos Personales within a maximum of 72 hours of becoming aware of the breach. The communication must carry relevant information, such as the certain or estimated date of the breach, its nature, the personal data affected and the possible impacts.
A processor that learns of a breach must tell the controller immediately. The controller must also tell the data subjects who suffered a significant effect on their rights, in clear and simple language. Once the breach is resolved, the controller must prepare a detailed report of the breach and the measures adopted and send it to the Unidad Reguladora y de Control de Datos Personales. The decree was promulgated on and published on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.