Law 18.331 is Uruguay's Personal Data Protection Act, establishing rules for the processing and protection of personal data. It was enacted in 2008 and is supplemented by Decree 414/009.

Does Uruguay require prior consent for personal-data processing?

Where consent is the applicable legal basis, Law 18.331 requires consent to be free, prior, express, and informed, and the consent must be documented. The law also provides specific exceptions to the consent requirement.

What does informed consent mean under Uruguay's data protection framework?

The implementing regulation requires consent information to clearly communicate the purpose for which the data will be used and the type of activity carried out by the data controller or processor.

Who regulates data protection in Uruguay?

The Unidad Reguladora y de Control de Datos Personales (URCDP) is Uruguay's supervisory authority for personal-data protection.

What rights do individuals have under Law 18.331?

The framework provides individuals with rights including access, rectification, cancellation, and opposition in accordance with the applicable provisions.

Does Uruguay require organizations to keep proof of consent?

Yes. Decree 414/009 provides that the data controller should collect and retain evidence of the existence of consent or the refusal to provide consent.

Does Law 18.331 apply to cookies and online tracking?

Law 18.331 regulates personal-data processing rather than cookies specifically. Where cookies, trackers, or similar technologies involve the processing of personal data, organizations should assess the applicable requirements under Uruguay's data-protection framework.

What is sensitive personal data under Law 18.331?

Uruguay's framework provides enhanced protection for sensitive personal data and establishes specific requirements governing its processing. Organizations should assess whether the information they process falls within the law's sensitive-data categories.

Uruguay

Law 18.331 Compliance

Uruguay Personal Data Protection Act

Law 18.331, Uruguay's Personal Data Protection Act, establishes the framework for protecting personal data and regulating its collection, storage, use, and processing. The law recognizes personal data protection as a fundamental right and establishes requirements for consent, transparency, security, and the exercise of data-subject rights.

Region

Uruguay

Status

In force since 2008

Regulator

Unidad Reguladora y de Control de Datos Personales (URCDP)

Group

Americas

Who Must Comply

Law 18.331 applies to public and private databases and to organizations processing personal data within its scope. The implementing regulations cover personal-data processing in both the public and private sectors and establish territorial rules for processing carried out by organizations established in Uruguay or, in certain circumstances, organizations using processing means located in Uruguay.

Penalties

The Unidad Reguladora y de Control de Datos Personales (URCDP) supervises Uruguay's personal-data protection framework. The applicable enforcement framework provides for administrative sanctions, including warnings, fines, and suspension of databases or related processing activities in applicable circumstances.

Key Obligations

Obtain free, prior, express, and informed consent where consent is required.
Clearly communicate the purpose of processing personal data.
Inform individuals about relevant recipients or uses of their personal information.
Maintain appropriate evidence of consent or refusal.
Respect applicable rights relating to access, rectification, cancellation, and opposition.
Implement appropriate security measures for personal-data processing.
Maintain appropriate privacy policies and data-processing practices.
Register databases where registration is required under the applicable framework.
Apply additional safeguards when processing sensitive personal data.
Comply with applicable requirements for reporting personal-data security incidents.

How ConsentX Helps

ConsentX helps organizations manage consent, privacy preferences, and data-subject workflows while maintaining an auditable record of user choices.

Prior & Express Consent

Capture consent through clear, affirmative opt-in experiences designed to support Uruguay's consent requirements.

Clear Purpose & Privacy Notices

Present visitors with transparent information about why their personal data is being collected and how it may be processed.

Consent Records & Evidence

Maintain detailed consent receipts containing information about user choices, consent status, and the relevant consent event.

Data Subject Request Management

Centralize workflows for managing applicable requests relating to access, correction, deletion, objection, and other privacy rights.

Uruguay-Specific Consent Rules

Configure region-specific consent experiences through ConsentX's rule engine to support requirements applicable to visitors in Uruguay.

Cookie & Tracker Management

Scan your website to identify cookies and trackers and control non-essential technologies based on the applicable consent configuration.

Get Law 18.331 Ready with ConsentX

Simplify consent management, strengthen privacy workflows, and maintain audit-ready records with ConsentX.

Get Started Free Book a Demo

This page provides general information about Uruguay's data protection framework and is not legal advice. Organizations should confirm their specific obligations with qualified Uruguayan privacy counsel.

How to Comply with Law 18.331 Using ConsentX

1
Scan Your Website
Run a free website scan to identify cookies, trackers, and other technologies that may collect or process visitor information.
2
Show a Geo-Aware Consent Banner
Deploy the ConsentX consent banner with region-specific settings to provide visitors with an appropriate consent experience.
3
Block Trackers Until Consent
Keep non-essential cookies and trackers blocked until the visitor provides the required consent.
4
Record Consent Evidence
Store consent choices and related information in consent receipts, helping your organization maintain evidence of how consent was obtained.
5
Manage Data Requests
Use ConsentX's DSAR workflow to organize and track privacy requests and help your team respond within applicable legal timelines.