UruguayLey 20.212, Cybersecurity Obligations of Public and Critical-Sector Entities
In force since .
A sector security regimes rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds public entities and private entities linked to services or sectors critical to the country, as article 78 refers to them through article 149 of Ley N° 18.719 (reached by declaring that you operate an essential service).
- Adopt effective security measures to protect your critical information assets, following the guidelines the Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y del Conocimiento (AGESIC) indicates (article 78(A)).
- Designate an information security officer and communicate the designation to AGESIC (article 78(B)).
- Plan the measures needed to mitigate and improve your existing controls, and adopt the prevention measures the regulations determine (article 78(C)).
- Incorporate, according to your level of maturity, the cybersecurity framework AGESIC developed (article 78(E)).
- Comply with other measures the Executive Power determines to protect information assets, following national and international standards (article 78(F)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Agencia para el Desarrollo del Gobierno de Gestión Electrónica y la Sociedad de la Información y del Conocimiento (AGESIC), which may require procedural adjustments, require specific risk-prevention measures, require supplementary information on incidents, and issue a warning (apercibir) to an entity that breaches article 78.
Settledness
- As of
- Open questions
- Which entities count as private entities linked to services or sectors critical to the country, given that article 78 refers to article 149 of Ley N° 18.719 and Decreto N° 66/025 lists the critical sectors?
What this law does
Article 78(A) of the Act requires public entities and private entities linked to services or sectors critical to the country to adopt effective security measures to protect their critical information assets, following the guidelines AGESIC indicates.
Article 78(B) and (C) of the Act require those entities to designate an information security officer and communicate it to AGESIC, and to plan measures to mitigate and improve existing controls and adopt the prevention measures the regulations determine. Article 78(E) and (F) of the Act require those entities to incorporate the AGESIC cybersecurity framework according to their maturity level and to comply with other measures the Executive Power determines.
Article 79 of the Act empowers AGESIC, for an entity that breaches article 78, to require adjustment of its procedures, to require specific risk-prevention measures, to require supplementary information on incidents, and to issue a warning considering the gravity or repetition of the breach. Article 2 of the Act provides that it governs from except for provisions that expressly set another date.
When LexLint raises it
When your app profile says your app runs an essential service.