Uruguay

Article 4, literal Ñ, added by Ley N° 19.924 art. 86, defines biometric data as personal data obtained from a specific technical process relating to a natural person's physical, physiological, or behavioral characteristics that allow or confirm their unique identification, such as fingerprint data, image recognition, or voice recognition.

Article 18-BIS, added by Ley N° 19.924 art. 87, requires that any processing of biometric data first pass through a data protection impact assessment and fit within one of the lawful bases article 9 allows, a dedicated duty distinct from the sensitive-data list at article 4 literal E, which does not name biometric data.

Article 4 of Decreto N° 64/020 requires the controller, once it establishes that a security breach affecting data protection has occurred, to communicate it to the Unidad Reguladora y de Control de Datos Personales within a maximum of 72 hours of becoming aware of the breach. The communication must carry relevant information, such as the certain or estimated date of the breach, its nature, the personal data affected and the possible impacts.

A processor that learns of a breach must tell the controller immediately. The controller must also tell the data subjects who suffered a significant effect on their rights, in clear and simple language. Once the breach is resolved, the controller must prepare a detailed report of the breach and the measures adopted and send it to the Unidad Reguladora y de Control de Datos Personales. The decree was promulgated on 17 February 2020 and published on 21 February 2020.

Article 38, now regulated by Decreto N° 64/020 of 2020, requires the controller or processor of a database, on becoming aware of a security breach, to inform both the affected data subjects and the Unidad Reguladora y de Control de Datos Personales immediately and in detail, together with the measures adopted, coordinating the response with the Centro Nacional de Respuesta a Incidentes de Seguridad Informática del Uruguay (CERTuy).

The provision states no fixed numeric deadline, only immediacy from the moment the controller or processor becomes aware of the breach, and leaves the detailed content of that notification to the implementing regulation, Decreto N° 64/020. Article 4 of Decreto N° 64/020 sets a maximum of 72 hours from the controller's awareness of a security breach for communicating it to the Unidad Reguladora y de Control de Datos Personales.

Article 9 requires free, prior, express, and informed consent before processing personal data, documented in writing, subject to narrow exceptions for data drawn from public sources, gathered for a state function, or arising from a contractual, scientific, or professional relationship.

Article 10 requires the responsible party to adopt the security measures needed to prevent unauthorized alteration, loss, consultation, or processing of personal data, and article 11 binds anyone who legitimately accesses another party's database to reserve and professional secrecy, backed by the existing offense at article 302 of the Penal Code.

Article 17 lets personal data be communicated to a third party only for a purpose tied to the sender's and recipient's legitimate interest and only with the data subject's prior consent. Articles 24 and 29 require every public or private database to be registered with the Unidad Reguladora y de Control de Datos Personales before it operates, declaring the categories of data it holds.

Article 22 limits a negative commercial-debt record concerning a natural person to five years from its entry, renewable once, and article 20 requires an operator of a public communications network or electronic communications service to secure that network and warn subscribers of a particular security risk. Ley N° 18.331 states no day of its own entry into force, and article 1 of the Civil Code deems a promulgation known ten days after it takes place in the capital. The Law was promulgated on 11 August 2008 and published in the Diario Oficial on 18 August 2008.

Article 12 of Ley N° 18.331, as rewritten by Ley N° 19.670 art. 39, imposes a proactive-accountability duty of privacy by design, privacy by default, and a data-protection impact assessment. Ley N° 19.670 art. 37 extends Ley N° 18.331 to a controller or processor established outside Uruguay when its processing relates to offering goods or services to people in Uruguay or analyzing their behavior, when international law or a contract so provides, or when it uses means located in the country.

Ley N° 19.670 art. 40 requires a public entity, a wholly or partly state-owned entity, or a private entity that processes sensitive data as a main line of business or processes large volumes of data, to designate a data-protection officer with technical autonomy. Article 2 of Ley N° 19.670 makes the law govern from 1 January 2019, except for provisions that expressly set another date of effect.

Article 23 prohibits transferring personal data of any kind to a country or international body that does not provide an adequate level of protection under international or regional legal standards.

That prohibition does not reach judicial cooperation, medical-data exchange for public health reasons, banking or stock-exchange transactions, a treaty Uruguay is party to, or intelligence cooperation against organized crime, terrorism, or drug trafficking, and it also yields where the data subject unambiguously consents, the transfer is contractually necessary, an important public interest or a legal proceeding requires it, the data subject's vital interest is at stake, or the transfer comes from a register meant to inform the public.

Absent an adequate-protection finding and outside those exceptions, the Unidad Reguladora y de Control de Datos Personales may still authorize a transfer, or a series of transfers, to a country that does not guarantee an adequate level of protection where the controller offers sufficient contractual safeguards for privacy and fundamental rights.

Ley N° 18.331 states no day of its own entry into force, and article 1 of the Civil Code deems a promulgation known ten days after it takes place in the capital. The Law was promulgated on 11 August 2008 and published in the Diario Oficial on 18 August 2008.

Article 16, in the wording given by Ley N° 18.719 of 2010, gives a person the right not to be subjected to a decision with legal effects that significantly affects them, based on automated processing intended to assess aspects of their personality such as work performance, creditworthiness, reliability or conduct.

It lets the affected person challenge an administrative act or a private decision that assesses their conduct where personal-data processing offering a definition of their characteristics or personality is its sole basis, and in that case gives them the right to obtain from the database controller both the assessment criteria and the program used in the processing behind the decision.

Article 13, as rewritten by Ley N° 20.075 art. 62, requires telling a data subject, before or when their data is collected, the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, particularly for sensitive data, the consequences of refusing or of inaccuracy, the rights available under articles 14 to 16, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.

Article 14 gives a data subject free access, at most every six months, to all information about them held in a public or private database, supplied within five business days in clear language, covering the whole record without revealing a third party's data.

Article 15 gives a right to rectification, updating, inclusion, or deletion of erroneous, false, or missing personal data, to be carried out within five business days of the request, or the controller must give the reasons it considers the request does not apply, with any recipient of the data notified of the change within five business days.

Article 21 lets a data subject exercise the right of access free of charge in a marketing, canvassing, or profiling database, and request the withdrawal or blocking of their data from it at any time. The sections this entry groups came into force on different days.

Article 31 creates the Unidad Reguladora y de Control de Datos Personales as a technically autonomous body within AGESIC, and article 34, as rewritten in 2010 and 2022, gives it the power to inspect a controller's or processor's books, documents, and files, demand their appearance to provide information, and, in serious cases, seize materials for up to six business days, with judicial backing for a search of private premises.

Article 35 arms the authority with graduated administrative sanctions for a violation of the law: observation, warning, a fine of up to UI 500,000 (Unidades Indexadas, an inflation-linked accounting unit), a five-day suspension, or closure of the database, and lets it seek judicial closure of a database found to infringe the law.

The Act creates no separate criminal offense of its own; article 11 only cross-references the pre-existing professional-secrecy offense at article 302 of the Penal Code.

Article 37 gives any person the right to bring an effective habeas data judicial action against a public or private database's controller to learn what personal data about them it holds, its purpose and use, and to demand its rectification, inclusion, suppression, or another appropriate remedy where the data is erroneous, false, prohibited from processing, discriminatory, or outdated, with articles 38 to 45 setting the court, standing, and summary procedure for that action. The sections this entry groups came into force on different days.

Article 18 bars requiring anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life, as article 4 literal E defines it), and permits its processing only with the data subject's express written consent.

Absent that consent, article 18 allows collection and processing only where an interest-general law authorizes it or the requesting body has a legal mandate, or for statistical or scientific purposes once the data is disassociated from its subject.

Article 18 also bars forming a database whose content directly or indirectly reveals sensitive data, except for a political party, union, church, or other nonprofit body that processes only its own members' data for its own political, religious, or similarly aligned purpose, and never without the member's consent to any further communication of that data.

Article 19 lets a public or private health establishment or a health professional collect and process a patient's physical or mental health data only under the rules of professional secrecy and the specific health-sector regulations, alongside this law. Ley N° 18.331 states no day of its own entry into force, and article 1 of the Civil Code deems a promulgation known ten days after it takes place in the capital. The Law was promulgated on 11 August 2008 and published in the Diario Oficial on 18 August 2008.

Article 297 bis (acceso ilícito a datos informáticos) punishes with six to twenty-four months' imprisonment anyone who, by computer or telematic means, without authorization and without just cause, accesses, interferes with, discloses, sells, or transfers another's information held on a digital medium; because the offence's trigger is acting without authorization, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Article 297 ter punishes unauthorized interception of non-public data transmissions with the same six-to-twenty-four-month range.

Article 297 quater (vulneración de datos) punishes, with the same six-to-twenty-four-month range, accessing, appropriating, using, or modifying a third party's confidential data held on a digital or other medium without the holder's authorization, and separately punishes disclosing, revealing, or transferring such data to a third party with one to four years' imprisonment, aggravated where the data are personal data protected under Ley N° 18.331.

Article 358 quater (daño informático) punishes destroying, altering, or rendering unusable data or computer systems without authorization and with intent to cause harm with six to twenty-four months' imprisonment. Article 358 quinquies (abuso de los dispositivos) punishes producing, acquiring, importing, marketing, or supplying to a third party a program, system, or access credential unequivocally intended for committing an offence, with the same six-to-twenty-four-month range.

Ley N° 20.327 states no day of its own entry into force; absent a stated day, article 1 of the Civil Code brings an undated law into force ten days after its promulgation is verified in the capital, a computed day rather than one a source states.

Article 44 treats reproducing, distributing, communicating, or making a work available to the public without the author's consent as illicit reproduction, so copying a copyrighted text found on the open web without permission or an applicable exception infringes unless article 45 covers it. Article 45 numeral 4 excepts a transcription made for the purpose of comment, criticism, or controversy, a general quotation right rather than a text-and-data-mining exception.

Article 45 numeral 3 excepts news, reports, journalistic information, or recordings of general interest, but only where the exact version is preserved and the source is stated, a condition suited to a verbatim press clipping rather than to extracting short snippets or training a model on the underlying text.

Uruguay has no text-and-data-mining exception and no machine-readable opt-out mechanism of that kind; a service that reproduces or trains on scraped copyrighted text rests only on the numeral 4 quotation ground if its use can be characterised as comment, criticism, or controversy. The sections this entry groups came into force on different days.

Article 5 protects a compilation of data or other materials, in any form, as a copyright work when the selection or arrangement of its contents constitutes an intellectual creation, and states expressly that this protection does not extend to the underlying data or materials themselves and is without prejudice to any copyright that subsists in them separately.

Uruguay confers no sui generis database right distinct from this originality-based compilation copyright, so a database whose selection or arrangement is not itself an intellectual creation, such as a routine or exhaustive listing, receives no protection under this article, and copying the underlying facts or data out of a protected compilation does not infringe it. Article 5 in its present wording is the text that Ley N° 17.616 set out anew in its article 3.

Ley N° 17.616 states no day of its own entry into force; absent a stated day, article 1 of the Civil Code brings an undated law into force ten days after its promulgation is verified in the capital, a computed day rather than one a source states.

Article 2 of the decree applies it to all public entities and to private entities linked to services or sectors critical to the country. Article 3(j) of the decree defines the critical sectors as health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services and defense, and other sectors the Executive Power determines.

Article 10(a) of the decree requires those entities to adopt effective security measures to protect their critical information assets, following the guidelines of AGESIC. Article 14 of the decree requires the entities it binds to adopt the Marco de Ciberseguridad developed by AGESIC and to meet the minimum maturity level assigned to their profile. Article 16 of the decree requires those entities to carry out audits under the Marco de Ciberseguridad at the periodicity AGESIC defines.

Article 21 of the decree lets AGESIC warn directly an entity that fails to meet the decree. Article 22 of the decree repeals Decrees 451/009 and 452/009 of 28 September 2009.

Article 78(A) of the Act requires public entities and private entities linked to services or sectors critical to the country to adopt effective security measures to protect their critical information assets, following the guidelines AGESIC indicates.

Article 78(B) and (C) of the Act require those entities to designate an information security officer and communicate it to AGESIC, and to plan measures to mitigate and improve existing controls and adopt the prevention measures the regulations determine. Article 78(E) and (F) of the Act require those entities to incorporate the AGESIC cybersecurity framework according to their maturity level and to comply with other measures the Executive Power determines.

Article 79 of the Act empowers AGESIC, for an entity that breaches article 78, to require adjustment of its procedures, to require specific risk-prevention measures, to require supplementary information on incidents, and to issue a warning considering the gravity or repetition of the breach. Article 2 of the Act provides that it governs from 1 January 2024 except for provisions that expressly set another date.

Article 10(g) of the decree requires the entities it binds to communicate the occurrence of a cybersecurity incident to CERTuy within 24 hours of becoming aware of it, in the form and conditions CERTuy sets. Article 12(a) and (b) of the decree require those entities to report a potential cybersecurity incident fully and immediately under CERTuy criteria and to make available the information CERTuy or the sector computer security incident response team (CSIRT) requires, within the times requested.

Article 12(c) of the decree requires those entities to repair the consequences of incidents that affect critical information assets in accordance with the recommendations informed. Article 21 of the decree lets AGESIC warn directly an entity that fails to meet the decree. The decree was promulgated on 20 February 2025 and published on 14 March 2025.

Article 78(D) of the Act requires public entities and private entities linked to services or sectors critical to the country to report the existence of a potential cybersecurity incident fully and immediately, under the criteria CERTuy sets, and to make available the information CERTuy requires.

Article 80 of the Act requires those entities to communicate the occurrence of a cybersecurity incident to AGESIC within twenty-four hours of becoming aware of it and to complete the information needed for the registry as soon as possible. Article 80 of the Act creates the National Cybersecurity Incident Registry, administered by AGESIC.

Article 79 of the Act empowers AGESIC, for an entity that breaches article 78, to require supplementary information on incidents and to issue a warning considering the gravity or repetition of the breach. Article 2 of the Act provides that it governs from 1 January 2024 except for provisions that expressly set another date.

Resolución RR-SSF-2021-353 tells financial intermediation institutions and larger credit-administering companies that they must present information on every event that could affect services or clients and that, by its impact, affects operational or reputational risk.

The resolution requires those entities to report as a minimum events that meet its thresholds, including an interruption of a customer channel of 30 minutes or more and exposure of sensitive information and personal data of 5% or more of clients. The resolution requires an emerging event to be communicated as soon as possible after it becomes known and a scheduled event at least 24 hours before it starts. The resolution applies to events detected on or after 1 July 2021.

The resolution rests on literal H of article 38 of Ley 16.696 and on articles 490 and 582.1 of the Recopilación de Normas de Regulación y Control del Sistema Financiero. Literal L of article 38 of Ley 16.696 empowers the Superintendencia to apply observations, warnings and fines of up to 10% of the basic net worth of banks to supervised entities that breach the general norms or particular instructions issued to them.

Article 45 lists cases that are not illicit reproduction. Numeral 3 excepts news, reports, journalistic information, or recordings of general interest from the consent that article 44 otherwise requires, on the sole conditions that the exact version is preserved and the source is stated.

The exception is not capped at a headline or short-extract length and is not confined to the press industry, but the requirement to keep the exact version suits reproducing a news item whole, the way a press clipping does, rather than obviously covering an aggregator's extraction of a headline or a short snippet distinct from the source's own wording. No reported Uruguayan decision has applied numeral 3 to a systematic news aggregator as opposed to a traditional press review or broadcaster.

Separately, article 5 confines copyright to expressions and excludes ideas, procedures, operating methods, and mathematical concepts as such, so a bare fact or the news of the day is never itself a protected work under Uruguayan law. Uruguay has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located case law on hyperlinking or framed display.

Ley N° 9.739 states no day of its own entry into force; absent a stated day, article 1 of the Civil Code brings an undated law into force ten days after its promulgation is verified in the capital, a computed day rather than one a source states.