Uruguay

Uruguay's reach beyond its borders was added by articles 37 to 40 of Law 19.670 of 15 October 2018. Article 2 of Decree 64/020 of 17 February 2020 spells it out. The regulator reads 'means situated in the country' very broadly. Its own guidance for foreign companies says the means can be technical, human, physical, logical or other. Any of them creates a link with Uruguayan territory. The transit-only exemption works only if you appoint a representative based in Uruguay and registered with the regulator. You also cannot contract out of the law. The guidance says the parties may never exclude Uruguayan law where it applies.

INDUSTRY BY INDUSTRY, checked 19 August 2026. BANKING and most other firms supervised by the central bank (a copy must stay in the country). Article 35.1.1 of the central bank's consolidated financial rulebook requires express prior authorisation from the Financial Services Superintendency. You need it for any outsourced service supplied from abroad. You also need it where the supplier sits in Uruguay but does the work wholly or partly from abroad. Article 35.3 then says that where data is handled abroad, one of the backup copies required by article 492 must be physically located in Uruguay. There is only one way to skip the in-country copy. You build a single physical access point inside Uruguay, at head office or a branch. It needs the infrastructure and the decryption keys to reach every offshore system continuously. You must test it at least once a year. Sometimes the offshore work counts as 'significant'. That means more than 15 per cent of gross income. Or more than 20 per cent of the cost of handling the data. Or no realistic alternative supplier. Then the host country must be rated BBB- or better. Or the supplier must be a bank rated BBB+ or better. Or it must be inside the same financial group. The same article applies to credit administrators, financial services companies, representative offices and crowdfunding platform operators, but without the 'significant' test. INSURANCE and REINSURANCE (a copy must stay in the country). Articles 16.1.1, 16.3 and 120.3 of the insurance rulebook were replaced by Circular 2422 of 30 December 2022. They carry word for word the same permission duty, the same in-Uruguay backup copy, and the same single access point alternative. SECURITIES and MARKETS (a copy must stay in the country). The securities rulebook is current to Circular 2508 of 7 August 2026. It repeats the identical wording for stock exchanges, intermediaries, fund managers and other supervised market firms. It cross-refers to its own article 255.2. CENTRAL GOVERNMENT (data must stay in the country). Article 3 of Decree 92/014 of 7 April 2014 requires Central Administration computer systems to sit in secure data centres inside the country. The only exception is systems that pose no risk. AGESIC, the digital government agency, polices this and may grant exceptions on properly reasoned grounds. EDUCATION. We found no rule about where data must be stored. Public education bodies still go through the regulator one transfer at a time. The national education technology plan Ceibal needed its own transfer permission in April 2026. HEALTH. We found no storage-location rule in the national electronic health record decree, checked 19 August 2026. Health data is sensitive data under the general law, so you need a transfer impact assessment. TELECOMS, GAMBLING, MAPPING, DEFENCE. We found no rule requiring data to stay in the country, checked 19 August 2026. Online gambling is not regulated at all yet.

Article 23 of Law 18.331 sets the ban and its exceptions. Resolution 23/021 of 8 June 2021 replaced the earlier 2019 list and removed the United States. Resolution 63/023 of 21 November 2023 set the current list. It covers the European Union and European Economic Area member states. It also covers Andorra, Argentina, Canada for the private sector, Guernsey, the Isle of Man and the Faroe Islands. And Israel, Japan, Jersey, New Zealand, the United Kingdom and Switzerland. It added two more. South Korea, for organisations under its Personal Information Protection Act. And the United States, but only for organisations on the Data Privacy Framework list published by the US Department of Commerce. Transfers still follow the limits and exceptions in the European decisions that approved those countries. Resolution 8/026 was adopted in 2026 and announced by the regulator on 1 June 2026. It recommends the Council of Europe model contract clauses under Convention 108+. You need a data protection impact assessment before transferring to a place without adequate protection. The regulator grants individual permissions case by case and publishes them. Examples during 2026 include Ceibal in April 2026 and McKinsey and Company in June 2026.

Law 18.331 created the unit in 2008, with technical autonomy inside AGESIC. Here is the evidence of activity as at 19 August 2026. Over one thousand Executive Council resolutions are published. Resolution 42/025 of 19 December 2025 decided a complaint against Banco de la Republica Oriental del Uruguay. It was dismissed and no breach was found. Resolution 4/026 of 6 March 2026 dealt with a complaint against Alfa Plast. Resolution 9/026A of 24 April 2026 dealt with a complaint against G4S Secure Solutions Uruguay. Resolution 12/026 of 18 June 2026 authorised a transfer for McKinsey and Company. Database registration approvals continued steadily into August 2026. Article 35 of Law 18.331 sets the penalty ladder. It runs from observation, to warning, to a fine of up to 500,000 indexed units. Then a five-day suspension of the database, and finally its closure. One indexed unit was worth 6.6353 pesos on 19 August 2026, so the ceiling is about 3.3 million pesos. Money fines look rare in the published record. The unit's ordinary output is complaint rulings, opinions and registrations. That is why we rate enforcement as active rather than aggressive.

MINIMUMS. Article 497 of the central bank rulebook keeps company books for the twenty years set by the Commercial Code, counted from the last entry. It keeps documents, forms, correspondence and every other operational record for at least ten years. Article 297.2 requires anti-money-laundering customer files to be kept for at least five years after the relationship ends. Article 654 requires money transfer and cash-in-transit firms to keep transaction records for at least ten years. Article 10 of Decree 66/025 requires audit logs to be kept for at least twelve months. MAXIMUMS. Article 22 of Law 18.331 is the firm stop for credit and commercial debt data about individuals. It allows five years from the debt arising. One five-year renewal is available, but only if you ask in the thirty days before it expires. Debts already settled get a maximum of five years, which cannot be renewed, and must be marked as settled. The general principles of the law also require you to delete data once you no longer need it for the purpose you collected it for. CONFLICT. Uruguay publishes no single tie-breaker. Usually the industry minimum wins for that industry's records, because the law requires you to keep them. That does not let you reuse the data for anything else.

DEADLINE ONE, seventy-two hours. Decree 64/020 covers the company that decides how the data is used. It must tell the regulator within a maximum of 72 hours of learning about the breach. It must also tell affected people, in clear language, where they are significantly affected. DEADLINE TWO, twenty-four hours. Article 80 of Law 20.212 of 6 November 2023 covers public bodies, and private bodies linked to critical services or industries. They must report cybersecurity incidents to AGESIC within twenty-four hours of learning about them. Article 10 of Decree 66/025 repeats the twenty-four hour duty to CERTuy. That decree was signed on 20 February 2025 and published on 14 March 2025. Its article 12 adds a duty to report a possible incident fully and immediately. The decree also requires each covered body to name an information security officer with technical independence. DEADLINE THREE. Firms supervised by the central bank owe separate incident reporting to the Financial Services Superintendency, covering operations and outsourcing. We did not confirm a specific deadline in hours, and we have flagged that gap.

1. REGISTRATION IS REAL AND IT IS THE MAIN EVENT. You must register each database with the regulator, and keep doing so. The regulator's published output is dominated by these approvals. Numbered registration resolutions ran into the 240s by 7 August 2026. There is no minimum size, so a small customer list counts. 2. TWO PERMISSIONS, NOT ONE. Circular 2422 says the central bank's outsourcing permission does not replace anything you owe the Personal Data Regulation and Control Unit. You may still need database registrations and international transfer permissions from that unit. Getting the banking approval does not get you the privacy approval. The reverse is also true. 3. THE DATA PROTECTION OFFICER THRESHOLD IS LOW. Decree 64/020 requires one for all public bodies. It also requires one for private bodies whose core business involves sensitive data. And for any private body handling the personal data of more than thirty-five thousand people. That last number catches mid-size retailers and employers that would be well below a threshold elsewhere. 4. THE UNITED STATES IS ONLY PARTLY APPROVED. The United States sits on the approved list only for organisations on the Data Privacy Framework list kept by the US Department of Commerce. A US supplier that is not on that list counts as an unapproved destination. You then need clauses, consent or a specific permission. Uruguay removed the United States from the list entirely in 2021, so this has already flipped once. 5. GOVERNMENT CUSTOMERS BRING A HOSTING RULE. Decree 92/014 requires Central Administration systems to sit in secure data centres on Uruguayan soil. AGESIC can grant a reasoned exception. A cloud vendor bidding to a ministry may need local hosting, or an exception it does not control.

COMING. Article 74 of Law 20.212 told AGESIC to design a national data and artificial intelligence strategy with the privacy regulator. It must also give parliament recommendations for regulating artificial intelligence in law. Decree 276/025 of 2 December 2025 put the governance in place. On 26 May 2026 five state bodies launched controlled testing environments for data and artificial intelligence use. They include AGESIC, the industry ministry, the innovation agency and the privacy regulator. None of this is binding regulation yet. A government bill to regulate online gambling was trailed for the first half of 2026. We found no official text, and it is not law. POWERS THE GOVERNMENT ALREADY HOLDS, which matter more. 1. The privacy regulator can rewrite the list of approved destinations by its own resolution. No consultation and no notice are needed. It has done exactly that twice. It removed the United States in June 2021 and partly restored it in November 2023. Any approval you rely on can be withdrawn by a single resolution. 2. The Financial Services Superintendency decides for itself whether an offshore arrangement is 'significant'. That decision switches on host-country credit-rating conditions, and it can apply to arrangements already running. 3. The same Superintendency can order a supervised firm to stop using a named outsourcer. Every outsourcing contract must contain that termination ground. 4. AGESIC controls exceptions to the government hosting rule and may simply decline to renew one. 5. Uruguay ratified the updated Council of Europe data protection convention, known as Convention 108+, through Law 19.948. Work to line up with it is the most likely driver of the next round of domestic change.