🇺🇾Law 18.331 on Personal Data Protection and Habeas Data
Law 18.331 and Decree 64/020
Law 18.331 recognises personal-data protection as a fundamental right and establishes principles, data-subject rights, database registration, controller and processor duties, international-transfer rules and URCDP supervision.
Decree 64/020 extends the regime to specified extra-territorial processing, requires risk-based documented accountability, begins incident-impact procedures within 24 hours, requires regulator notification within 72 hours, and adds privacy by design/default and DPIA duties.
A delegate is mandatory for public and state-owned bodies and for private entities whose core business involves sensitive data or processing personal data of more than 35,000 people. Appointment, cessation or resignation must be communicated to URCDP within the prescribed 90-day period.