Law 18.331 Compliance

Law 18.331 is Uruguay's Personal Data Protection Act, establishing rules for the processing and protection of personal data. It was enacted in 2008 and is supplemented by Decree 414/009.

Where consent is the applicable legal basis, Law 18.331 requires consent to be free, prior, express, and informed, and the consent must be documented. The law also provides specific exceptions to the consent requirement.

The implementing regulation requires consent information to clearly communicate the purpose for which the data will be used and the type of activity carried out by the data controller or processor.

The Unidad Reguladora y de Control de Datos Personales (URCDP) is Uruguay's supervisory authority for personal-data protection.

The framework provides individuals with rights including access, rectification, cancellation, and opposition in accordance with the applicable provisions.

Yes. Decree 414/009 provides that the data controller should collect and retain evidence of the existence of consent or the refusal to provide consent.

Law 18.331 regulates personal-data processing rather than cookies specifically. Where cookies, trackers, or similar technologies involve the processing of personal data, organizations should assess the applicable requirements under Uruguay's data-protection framework.

Uruguay's framework provides enhanced protection for sensitive personal data and establishes specific requirements governing its processing. Organizations should assess whether the information they process falls within the law's sensitive-data categories.