Uruguay

Territorial reach was added by articles 37 to 40 of Law 19.670 of 15 October 2018 and spelled out in article 2 of Decree 64/020 of 17 February 2020. The regulator reads 'means situated in the country' very broadly: its own guidance for foreign entities says the means may be 'tecnicos, humanos, fisicos, logicos u otros' and that any of them creates a connecting point with Uruguayan territory. The transit-only carve-out is conditional on appointing a locally domiciled representative before the regulator. Note also that the law's parties cannot contract out of it: the guidance states that in no case may contracting parties exclude the application of Uruguayan law where it applies.

SECTOR BY SECTOR, checked 19 August 2026. BANKING and most other central-bank-supervised firms (a copy must stay in the country). Article 35.1.1 of the central bank's consolidated financial rulebook requires express prior authorisation from the Financial Services Superintendency for any outsourced service provided by a party abroad, and also where the provider sits in Uruguay but performs the service wholly or partly from abroad. Article 35.3 then says that where data is processed abroad, one of the backup copies required by article 492 'debera radicarse fisicamente en el Uruguay'. You may skip the in-country copy only if you build a single physical access point inside Uruguay, at head office or a branch, with the infrastructure and the decryption keys to reach every offshore system continuously, tested at least yearly. Where the offshore processing is judged 'significant' (more than 15 per cent of gross income, or more than 20 per cent of processing cost, or no realistic alternative provider), the host country must be rated BBB- or better, or the processor must be a bank rated BBB+ or better, or be inside the same financial group. The same article is applied, minus the 'significant' test, to credit administrators, financial services companies, representative offices and crowdfunding platform operators. INSURANCE and REINSURANCE (a copy must stay in the country). Articles 16.1.1, 16.3 and 120.3 of the insurance rulebook, replaced by Circular 2422 of 30 December 2022, carry word-for-word the same authorisation duty, the same in-Uruguay backup copy and the same unified access point alternative. SECURITIES and MARKETS (a copy must stay in the country). The securities rulebook, current to Circular 2508 of 7 August 2026, repeats the identical wording for stock exchanges, intermediaries, fund managers and other supervised market participants, cross-referring to its own article 255.2. CENTRAL GOVERNMENT (data must stay in the country). Article 3 of Decree 92/014 of 7 April 2014 requires Central Administration computer systems to be housed in secure data centres located in national territory, excepting only systems that pose no risk. AGESIC, the digital government agency, polices this and may grant exceptions on duly reasoned grounds. EDUCATION. No localisation rule found. Public education bodies still go through the regulator one transfer at a time: the national education technology plan Ceibal needed its own transfer authorisation in April 2026. HEALTH. No storage-location rule found in the national electronic health record decree, checked 19 August 2026. Health data is sensitive data under the general law, so a transfer impact assessment is required. TELECOMS, GAMBLING, MAPPING, DEFENCE. No data-localisation rule found, checked 19 August 2026. Online gambling is not yet regulated at all.

Article 23 of Law 18.331 sets the ban and its exceptions. Resolution 23/021 of 8 June 2021 replaced the earlier 2019 list and, importantly, removed the United States. Resolution 63/023 of 21 November 2023 restored the current list: the European Union and European Economic Area member states, Andorra, Argentina, Canada for the private sector, Guernsey, the Isle of Man, the Faroe Islands, Israel, Japan, Jersey, New Zealand, the United Kingdom and Switzerland, plus two additions: South Korea for entities under its Personal Information Protection Act, and the United States only for organisations appearing on the Data Privacy Framework list published by the US Department of Commerce. Transfers remain subject to the limits and carve-outs in the underlying European adequacy decisions. Resolution 8/026, adopted in 2026 and announced by the regulator on 1 June 2026, recommends the Council of Europe model contractual clauses under Convention 108+. A data protection impact assessment is required before transferring to a place without adequate protection. Individual authorisations are granted case by case and published: examples during 2026 include Ceibal in April 2026 and McKinsey and Company in June 2026.

The unit was created by Law 18.331 in 2008 with technical autonomy inside AGESIC. Observable evidence of activity as at 19 August 2026: over one thousand published Executive Council resolutions; Resolution 42/025 of 19 December 2025 deciding a complaint against Banco de la Republica Oriental del Uruguay (dismissed, no breach found); Resolution 4/026 of 6 March 2026 on a complaint against Alfa Plast; Resolution 9/026A of 24 April 2026 on a complaint against G4S Secure Solutions Uruguay; Resolution 12/026 of 18 June 2026 authorising a transfer for McKinsey and Company; and a steady stream of database registration approvals into August 2026. The sanction ladder in article 35 of Law 18.331 runs from observation, warning and fine of up to 500,000 indexed units, to a five-day suspension of the database and finally its closure. One indexed unit was worth 6.6353 pesos on 19 August 2026, so the ceiling is about 3.3 million pesos. Money fines appear rare in the published record; the unit's ordinary output is complaint rulings, opinions and registrations. That is why enforcement is rated active rather than aggressive.

FLOOR. Article 497 of the central bank rulebook keeps company books for the twenty years set by the Commercial Code, counted from the last entry, and keeps documents, forms, correspondence and every other operational record for not less than ten years. Article 297.2 requires anti-money-laundering customer files to be kept for at least five years after the relationship ends. Article 654 requires money transfer and cash-in-transit firms to keep transaction records for at least ten years. Article 10 of Decree 66/025 requires audit logs to be kept for at least twelve months. CEILING. Article 22 of Law 18.331 is the hard stop for credit and commercial debt data about individuals: five years from the debt arising, one single five-year renewal available only if requested in the thirty days before expiry, and a maximum non-renewable five years for debts already settled, which must be marked as settled. The general principles of the law also require data to be deleted when it is no longer needed for the purpose it was collected for. CONFLICT. Uruguay publishes no single tie-breaker. In practice the sector minimum wins for the sector record, because keeping it is a legal obligation, but that does not license reusing the data for anything else.

CLOCK ONE, seventy-two hours. Decree 64/020 requires the controller to notify the regulator within a maximum of 72 hours of becoming aware of the breach, and to notify affected individuals in clear language where they are significantly affected. CLOCK TWO, twenty-four hours. Article 80 of Law 20.212 of 6 November 2023 requires public entities and private entities linked to critical services or sectors to report cybersecurity incidents to AGESIC within twenty-four hours of becoming aware. Article 10 of Decree 66/025, promulgated 20 February 2025 and published 14 March 2025, repeats the twenty-four hour duty to CERTuy, and article 12 adds a duty to report a potential incident completely and immediately. The decree also requires each covered entity to name an information security officer with technical independence. CLOCK THREE. Central-bank-supervised firms owe separate operational and outsourcing incident reporting to the Financial Services Superintendency; we did not verify a specific deadline in hours and have flagged that gap.

1. REGISTRATION IS REAL AND IT IS THE MAIN EVENT. Registering each database with the regulator is a standing obligation, and the regulator's published output is dominated by these approvals: numbered registration resolutions ran into the 240s by 7 August 2026. There is no de minimis for a small customer list. 2. TWO PERMISSIONS, NOT ONE. The central bank spells out in Circular 2422 that its outsourcing authorisation is granted 'sin perjuicio de las inscripciones de las bases de datos y autorizaciones de transferencia internacional de datos personales que puedan corresponder ante la Unidad Reguladora y de Control de Datos Personales'. Getting the banking approval does not get you the privacy approval, and vice versa. 3. THE DATA PROTECTION OFFICER THRESHOLD IS LOW. Decree 64/020 requires one for all public bodies, for private bodies whose core business involves sensitive data, and for any private body handling the personal data of more than thirty-five thousand people. That last number catches mid-size retailers and employers that would be nowhere near a threshold elsewhere. 4. UNITED STATES ADEQUACY IS PARTIAL. The United States sits on the approved list only for organisations that appear on the Data Privacy Framework list kept by the US Department of Commerce. A US supplier that is not on that list is a non-adequate destination and needs clauses, consent or a specific authorisation. Uruguay removed the United States entirely from the list in 2021, so this has already flipped once. 5. GOVERNMENT CUSTOMERS BRING A HOSTING RULE. Decree 92/014 obliges Central Administration systems to sit in secure data centres on Uruguayan soil unless AGESIC grants a reasoned exception. A cloud vendor bidding to a ministry may need either local hosting or an exception it does not control.

COMING. Article 74 of Law 20.212 tasked AGESIC with designing a national data and artificial intelligence strategy jointly with the privacy regulator, and with delivering recommendations for legal regulation of artificial intelligence to parliament. Decree 276/025 of 2 December 2025 put the governance in place. On 26 May 2026 five state bodies, including AGESIC, the industry ministry, the innovation agency and the privacy regulator, launched controlled testing environments aimed specifically at data and artificial intelligence use. None of this is binding regulation yet. A government bill to regulate online gambling was trailed for the first half of 2026; we found no official text and it is not law. DORMANT SWITCHES, which matter more. 1. The privacy regulator can rewrite the approved-destinations list by its own resolution, with no consultation and no notice. It has done exactly that twice: removing the United States in June 2021 and partially restoring it in November 2023. Any adequacy finding you rely on can be withdrawn by a single resolution. 2. The Financial Services Superintendency decides, on its own judgement, whether a given offshore processing arrangement is 'significant'. That switch turns on host-country credit-rating conditions retrospectively for arrangements already running. 3. The same Superintendency may order a supervised firm to stop using a named outsourcer, a termination ground the rules require every outsourcing contract to contain. 4. AGESIC controls exceptions to the government hosting rule and may simply decline to renew one. 5. Uruguay ratified the modernised Council of Europe data protection convention, known as Convention 108+, through Law 19.948. Alignment work under it is the most likely driver of the next round of domestic change.