UruguayLey N° 18.331, enforcement, sanctions and habeas data
In force.
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Unidad Reguladora y de Control de Datos Personales to inspect your books, documents, and files, physical or electronic, demand your appearance to provide information, and, in serious cases, seize materials for up to six business days.
- Expect graduated administrative sanctions when you violate the law: observation, warning, a fine of up to UI 500,000 (Unidades Indexadas, an inflation-linked accounting unit), a five-day suspension, or closure of the database.
- Expect any person to be able to bring an effective habeas data judicial action against you to learn what personal data about them you hold, its purpose and use, and to demand its rectification, inclusion, suppression, or another appropriate remedy where the data is erroneous, false, prohibited from processing, discriminatory, or outdated.
These lines are LexLint's reading of the law's text. Also read by: Unidad Reguladora y de Control de Datos Personales (URCDP) (guidance, recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Criminal exposure note
Ley N° 18.331 creates only administrative sanctions (art. 35); art. 11 cross-references the pre-existing professional-secrecy offense at art. 302 of the Penal Code rather than creating a new crime for a violation of this Act.
Penalty structure
The cap is stated in Unidades Indexadas (UI), an inflation-linked accounting unit, and UYI is the ISO 4217 code for it, so the figure is not a peso amount. Article 35 lets the URCDP grade its sanctions by the gravity, repetition or recidivism of the infringement; the others are observation, warning, a five-day suspension of the database and closure of the database, which the URCDP may seek from a court.
- Rule
- Fixed only
- As of
- Currency
- UYI
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Unidad Reguladora y de Control de Datos Personales (URCDP)
Settledness
The compilation of the URCDP's resolutions covers 2009 to 2015.
- As of
- Guidance link
- https://www.gub.uy/unidad-reguladora-control-datos-personales/sites/unidad-reguladora-control-datos-personales/files/documentos/publicaciones/Principales%20criterios%20administrativos%202009-2015.pdf
- Guidance body
- Unidad Reguladora y de Control de Datos Personales (URCDP)
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 31 to 36 create the control body (Unidad Reguladora y de Control de Datos Personales), set out its functions and inspection powers (Article 34), its sanctions (Article 35, observation, warning, a fine of up to 500,000 indexed units, suspension and closure of the database) and the registration of codes of conduct (Article 36); Articles 37 to 45 regulate the habeas data court action. The control body's power to demand books, documents and files is a general power to demand production and names no record the controller must keep. Article 35 says the facts of an infringement are documented, which is the authority's own file, and registering a code of conduct is a filing. No log or record duty falls on a controller. No territorial clause sits in the cited articles.
- Kind
- None
- As of
What this law does
Article 31 creates the Unidad Reguladora y de Control de Datos Personales as a technically autonomous body within AGESIC, and article 34, as rewritten in 2010 and 2022, gives it the power to inspect a controller's or processor's books, documents, and files, demand their appearance to provide information, and, in serious cases, seize materials for up to six business days, with judicial backing for a search of private premises.
Article 35 arms the authority with graduated administrative sanctions for a violation of the law: observation, warning, a fine of up to UI 500,000 (Unidades Indexadas, an inflation-linked accounting unit), a five-day suspension, or closure of the database, and lets it seek judicial closure of a database found to infringe the law.
The Act creates no separate criminal offense of its own; article 11 only cross-references the pre-existing professional-secrecy offense at article 302 of the Penal Code.
Article 37 gives any person the right to bring an effective habeas data judicial action against a public or private database's controller to learn what personal data about them it holds, its purpose and use, and to demand its rectification, inclusion, suppression, or another appropriate remedy where the data is erroneous, false, prohibited from processing, discriminatory, or outdated, with articles 38 to 45 setting the court, standing, and summary procedure for that action. The sections this entry groups came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .