UruguayLey N° 19.670, accountability, extraterritorial scope and data-protection officer
Ley N° 19.670, de 15 de octubre de 2018, arts. 37, 39 y 40 (Ley N° 18.331, art. 12)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- DPIA, Governance
As of .
What it requires
- Adopt privacy-by-design, privacy-by-default, and data-protection impact assessment measures as part of a proactive-accountability duty, and be able to demonstrate their effective implementation.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkID.RA-P4
- If established outside Uruguay, treat processing that offers goods or services to people in Uruguay, analyzes their behavior, or uses means located in Uruguay as subject to Ley N° 18.331.
- If a public entity, a wholly or partly state-owned entity, or a private entity that processes sensitive data as a main line of business or processes large volumes of data, designate a data-protection officer with technical autonomy.NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 12 of Ley N° 18.331, as rewritten by Ley N° 19.670 art. 39, imposes a proactive-accountability duty of privacy by design, privacy by default, and a data-protection impact assessment. Ley N° 19.670 art. 37 extends Ley N° 18.331 to a controller or processor established outside Uruguay when its processing relates to offering goods or services to people in Uruguay or analyzing their behavior, when international law or a contract so provides, or when it uses means located in the country.
Ley N° 19.670 art. 40 requires a public entity, a wholly or partly state-owned entity, or a private entity that processes sensitive data as a main line of business or processes large volumes of data, to designate a data-protection officer with technical autonomy. Article 2 of Ley N° 19.670 makes the law govern from , except for provisions that expressly set another date of effect.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.