Data protection in Uruguay is regulated under Law 18,331 on the Protection of Personal Data and Habeas Data Act, enacted on August 2008, and its regulatory Decree 414/009 (hereinafter referred to as “DPA”).

Uruguay has long established its preference for the European regulation in relation to data protection. To the extent, that on August 2012 the European Commission issued a decision recognizing that Uruguay ensures an adequate level of protection within the meaning of Article 25(6) of Directive 95/46/EC of the European Parliament and the Council of Europe. In addition, Uruguay was the first non-European country to adhere to Convention 108 of the European Council, and has just recently incorporated said Convention’s amendments, marking once again Uruguay’s ties with European regulation on data protection. In fact, following the enacting of the General Data Protection Regulation (“GDPR”) in Europe, Uruguay passed Law 19,670, which includes provisions relating to data protection, addressing, among others, the “proactive responsibility” principle (which supposes the implementation of appropriate technical and organizational measures such as privacy by design and privacy by default), the obligation to designate a Data Protection Officer, and the rule of data breach notifications. These provisions were further developed under the regulatory Decree 64/020, which basically regulates the implementation and enforcement of the aforementioned provisions.

The proactive responsibility principle. As stated above, this principle entails the implementation of technical and organizational measures that include privacy by design, privacy by default and the evaluation of impact on data protection. These measures shall be duly documented, periodically revised and evaluated on its effectiveness.

Privacy by Design implies the compliance and offering of all guarantees necessary to assure the data protection from the outset, at the initial phase of any planification. On the other hand, Privacy by Default implies that if there are various privacy configurations, those that offer more security and privacy should be the ones marked by default, prevailing over others.

Data Protection Officer. Certain entities such as public entities, private entities owned by the government and private entities whose core activity is the processing of sensitive data or that manage large amount of data (defined in Regulatory Decree N° 64/020 as the managing of data of over 35,000 people) must count with a Data Protection Officer.

Following GDPR provisions, the Data Protection Officer shall be responsible for:

• formulating, designing and implementing data protection policies;
• monitoring the compliance with local legislation and regulation; and
• serving as a link with the Data Protection Authority.

For this purpose, the Data Protection Authority (“URCDP”) has created an online registry for the recording of Data Protection Officers.

Data breach notifications. A data breach is defined as any accidental or illegal security breach which could enable the disclosure, destruction, loss or modification of personal data, or the communication or access to the personal data by any unauthorized person.

If the data processor detects a breach of its security measures, the data processor shall immediately report the breach and the security measures to be adopted, to both the affected data subjects and the Data Protection Authority.

Within a 24-hour period since the occurrence of the breach, the data processor or responsible of the database shall take all necessary measures to reduce its impact.

Notification to the authorities should include relevant information regarding the date of occurrence, nature of the breach, personal data affected, and possible impact.

In addition, once the breach is cured, the responsible of the database must submit a report to the Data Protection Authority explaining the status of the data breach and the measures taken to cure it.

As it can be seen, Uruguayan local regulation on data protection is strongly connected to and aligned with the European one, enabling the possibility of continuing to be considered as a country that provides an adequate level of data protection and facilitating secure international data transfers with relevant data protection guarantees.