UruguayLey 20.212, Cybersecurity Incident Reporting by Public and Critical-Sector Entities
Ley N° 20.212, arts. 78(D) y 80
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds public entities and private entities linked to services or sectors critical to the country, as article 78 refers to them through article 149 of Ley N° 18.719 (reached by declaring that you operate an essential service).
- Report the existence of a potential cybersecurity incident fully and immediately, under the criteria the Centro Nacional de Respuesta a Incidentes de Seguridad Informática (CERTuy) sets, and make available all the information it requires (article 78(D)).
- Communicate the occurrence of a cybersecurity incident to AGESIC within twenty-four hours of becoming aware of it, and complete the information needed for the National Cybersecurity Incident Registry as soon as possible (article 80).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y del Conocimiento (AGESIC), which may require procedural adjustments, require supplementary information on incidents, and issue a warning (apercibir) to an entity that breaches article 78.
Settledness
- As of
- Open questions
- Is the twenty-four hour notice to AGESIC under article 80 of the Act one notification or two alongside the twenty-four hour notice to CERTuy under article 10(g) of Decreto N° 66/025?
What this law does
Article 78(D) of the Act requires public entities and private entities linked to services or sectors critical to the country to report the existence of a potential cybersecurity incident fully and immediately, under the criteria CERTuy sets, and to make available the information CERTuy requires.
Article 80 of the Act requires those entities to communicate the occurrence of a cybersecurity incident to AGESIC within twenty-four hours of becoming aware of it and to complete the information needed for the registry as soon as possible. Article 80 of the Act creates the National Cybersecurity Incident Registry, administered by AGESIC.
Article 79 of the Act empowers AGESIC, for an entity that breaches article 78, to require supplementary information on incidents and to issue a warning considering the gravity or repetition of the breach. Article 2 of the Act provides that it governs from except for provisions that expressly set another date.
When LexLint raises it
When your app profile says your app runs an essential service.