UruguayLey N° 18.331, cross border transfer of personal data
Ley N° 18.331, art. 23 (transferencia internacional de datos personales)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Transfer personal data outside Uruguay only to a country or organization that provides an adequate level of protection under international or regional legal standards, unless one of the law's listed exceptions applies (judicial cooperation, medical necessity, banking or stock-exchange transactions, an applicable treaty, or law-enforcement intelligence cooperation).
- Absent an adequate-protection finding, transfer personal data internationally only with the data subject's unambiguous consent, under a contractual-necessity exception, or after the Unidad Reguladora y de Control de Datos Personales authorizes the transfer based on the contractual safeguards you offer.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 23 prohibits transfers to countries or bodies without adequate protection, lists exceptions (judicial cooperation, medical exchange, bank and securities transfers, treaties, unambiguous consent, contract necessity and others) and lets the control body authorize a transfer on sufficient guarantees such as contractual clauses. These are conditions on the transfer and set no duty to keep a log or record of transfers, no audit and no body entitled to a record. No territorial clause sits in the cited article.
- Kind
- None
- As of
What this law does
Article 23 prohibits transferring personal data of any kind to a country or international body that does not provide an adequate level of protection under international or regional legal standards.
That prohibition does not reach judicial cooperation, medical-data exchange for public health reasons, banking or stock-exchange transactions, a treaty Uruguay is party to, or intelligence cooperation against organized crime, terrorism, or drug trafficking, and it also yields where the data subject unambiguously consents, the transfer is contractually necessary, an important public interest or a legal proceeding requires it, the data subject's vital interest is at stake, or the transfer comes from a register meant to inform the public.
Absent an adequate-protection finding and outside those exceptions, the Unidad Reguladora y de Control de Datos Personales may still authorize a transfer, or a series of transfers, to a country that does not guarantee an adequate level of protection where the controller offers sufficient contractual safeguards for privacy and fundamental rights.
Ley N° 18.331 states no day of its own entry into force, and article 1 of the Civil Code deems a promulgation known ten days after it takes place in the capital. The Law was promulgated on and published in the Diario Oficial on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .