Uruguay Law 18.331
Amended Uruguay · In force Aug 18, 2008 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Uruguay's data protection law, which treats data protection as a human right and covers consent, purpose limits, security, sensitive data, data subject rights and international transfers. Law 19.670 of 2018 added accountability duties, regulated by Decree 64/020. Uruguay holds EU adequacy status.
- Who it applies to
- Personal data recorded in any medium in Uruguay, by public or private entities.
- Penalties
- Observation, warning, fines up to 500,000 indexed units (UI), suspension of the database for five days, or closure of the database (Art. 35).
- Enforced by
- Unidad Reguladora y de Control de Datos Personales (URCDP)
- Official name
- Ley N° 18.331 de Protección de Datos Personales
- Citation
- Ley N° 18.331
- Topics
- privacy, data-residency
Verified 2026-09-25
Research notes
effective_date uses the publication date shown by IMPO. Regulated originally by Decree 414/009 of 2009-08-31.
Related
Questions about Uruguay Law 18.331
- What are the Uruguay Law 18.331 compliance deadlines?
- Aug 11, 2008: Law promulgated. Aug 18, 2008: Law published. Oct 15, 2018: Law 19.670 amendments. Feb 17, 2020: Decree 64/020.
- When does Uruguay Law 18.331 take effect?
- Uruguay Law 18.331 took effect on Aug 18, 2008.
- Who does Uruguay Law 18.331 apply to?
- Personal data recorded in any medium in Uruguay, by public or private entities.
- What are the penalties under Uruguay Law 18.331?
- Observation, warning, fines up to 500,000 indexed units (UI), suspension of the database for five days, or closure of the database (Art. 35).