UruguayLey N° 18.331, sensitive personal data and health data
Ley N° 18.331, de 2008, arts. 4 (literal E), 18 y 19 (datos sensibles y datos relativos a la salud)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not require anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life), and process what you do collect only with the data subject's express written consent.
- Collect and process sensitive data absent that consent only where an interest-general law authorizes it, the requesting body has a legal mandate to do so, or the purpose is statistical or scientific and the data is disassociated from its subject.
- Do not build a database whose content directly or indirectly reveals sensitive data, unless you are a political party, union, church, or other nonprofit body processing only your own members' sensitive data for your own political, religious, or similarly aligned purpose, and even then never communicate it further without the member's consent.
- If you are a health establishment or a health professional, collect and process a patient's physical or mental health data only under the rules of professional secrecy and the applicable health-sector regulations.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 18 conditions the processing of sensitive data on the data subject's express written consent, which is a condition of processing and does not itself require the controller to keep a consent record; Article 4(E) defines sensitive data and Article 19 lets health establishments and professionals process health data subject to professional secrecy and the specific rules. None of the cited provisions requires a log, register or record of processing, and none names an audit or a body entitled to a record. The consent-documentation duty is in Article 9, which this row does not cite. No territorial clause sits in the cited articles.
- Kind
- None
- As of
What this law does
Article 18 bars requiring anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life, as article 4 literal E defines it), and permits its processing only with the data subject's express written consent.
Absent that consent, article 18 allows collection and processing only where an interest-general law authorizes it or the requesting body has a legal mandate, or for statistical or scientific purposes once the data is disassociated from its subject.
Article 18 also bars forming a database whose content directly or indirectly reveals sensitive data, except for a political party, union, church, or other nonprofit body that processes only its own members' data for its own political, religious, or similarly aligned purpose, and never without the member's consent to any further communication of that data.
Article 19 lets a public or private health establishment or a health professional collect and process a patient's physical or mental health data only under the rules of professional secrecy and the specific health-sector regulations, alongside this law. Ley N° 18.331 states no day of its own entry into force, and article 1 of the Civil Code deems a promulgation known ten days after it takes place in the capital. The Law was promulgated on and published in the Diario Oficial on .
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .