UruguayLey N° 19.670, personal data breach notification
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the affected data subjects immediately and in detail on becoming aware of the breach, describing the measures adopted to address it.
- Notify the Unidad Reguladora y de Control de Datos Personales immediately and in detail on becoming aware of the breach, coordinating your response with the national cybersecurity incident response center (CERTuy).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 38 requires a controller or processor that learns of a security breach to inform the data subjects and the control body, immediately and in detail, of the breach and the measures taken, and leaves the content of the information to the regulation. It is a duty to notify and says nothing of keeping a register or document of breaches. The follow-up report the regulation requires after a breach is solved (Decreto N° 64/020, Article 4) is coded on that decree's own row. No territorial clause sits in the cited article.
- Kind
- None
- As of
What this law does
Article 38, now regulated by Decreto N° 64/020 of 2020, requires the controller or processor of a database, on becoming aware of a security breach, to inform both the affected data subjects and the Unidad Reguladora y de Control de Datos Personales immediately and in detail, together with the measures adopted, coordinating the response with the Centro Nacional de Respuesta a Incidentes de Seguridad Informática del Uruguay (CERTuy).
The provision states no fixed numeric deadline, only immediacy from the moment the controller or processor becomes aware of the breach, and leaves the detailed content of that notification to the implementing regulation, Decreto N° 64/020. Article 4 of Decreto N° 64/020 sets a maximum of 72 hours from the controller's awareness of a security breach for communicating it to the Unidad Reguladora y de Control de Datos Personales.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .