Others

Cybersecurity in Uruguay: When a Cyberattack Becomes More Than Just an IT Problem

By Manuel Pittaluga, Pittaluga Abogados

For a long time, cybersecurity incidents were viewed primarily as a technical problem. In the event of an attack, a vulnerability, or an information breach, the response seemed fairly straightforward: contact the IT department, contain the incident, restore the systems, and resume operations.

However, Uruguay’s regulatory framework is increasingly making it clear that cybersecurity must also be examined from another perspective: legal liability and compliance.

A recent example is Decree No. 168/026, dated July 17, 2026, which amends Decree No. 66/025 and establishes new cybersecurity management obligations for the public sector.

One of the most interesting developments is the introduction of Article 20 bis. Upon detecting an information security incident, the entities covered by the regulation must immediately initiate the corresponding administrative procedures.

Perhaps the most significant aspect emerges when examining why the incident occurred. If it resulted from a lack of foresight, inadequate processes, the use of obsolete or outdated systems, or failure to comply with the measures set out in the Cybersecurity Framework, the entity must implement the necessary adjustments or adaptations and inform AGESIC.

This raises what I believe is a fundamental question: Is it enough to say, “We were the victims of a cyberattack”?

Increasingly, the answer appears to be no. It will also be necessary to determine whether the organization had previously adopted reasonable and appropriate measures to prevent, detect, and respond to the incident.

This development does not arise in isolation. Decree No. 66/025 had already established obligations relating to the reporting of potential incidents, cooperation with CERTuy, the retention of audit logs, and compliance with the Cybersecurity Framework.

Uruguay’s Cybersecurity Framework 5.0 is also aligned with the NIST Cybersecurity Framework 2.0 and organizes its requirements around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

The first of these functions is particularly significant: Govern. Cybersecurity should no longer be understood exclusively as the responsibility of the technology department. It also involves internal policies, the allocation of responsibilities, risk assessments, vendor contracting, training, incident response procedures, and management decisions. In short, it is progressively becoming a matter of governance and compliance.

There is another aspect of particular interest to the private sector. Decree No. 66/025 requires covered entities to ensure that outsourced services comply with the Cybersecurity Framework. Consequently, the impact of these requirements does not necessarily stop at the doors of a public-sector organization.

Software companies, cloud service providers, infrastructure providers, data storage companies, IT support firms, and other service providers contracting with covered entities may face increasingly stringent contractual and technical security requirements.

This also calls for greater attention to the negotiation of technology contracts. What security standards must the provider meet? Who must report an incident, and within what timeframe? Who is liable if a vulnerability in the provider’s systems compromises the client’s systems or information? Should audit rights be included? Who bears the costs arising from an incident?

These are questions that should progressively become part of any significant technology contract.

Another legal dimension must also be considered: personal data protection. Many cybersecurity incidents also involve personal data breaches.

Consider, for example, a ransomware attack that provides access to a database containing information about thousands of individuals. A single event may have consequences for both cybersecurity and data protection, while also giving rise to administrative and contractual liability and, potentially, civil liability.

This makes it necessary to abandon the idea that a security incident belongs exclusively to the IT department. When personal data, third-party contracts, confidential information, or essential services are involved, prevention and response necessarily require a multidisciplinary approach.

Decree No. 168/026 applies to the public-sector entities covered by the regulation, and its obligations should not automatically be extended to the private sector as a whole. Nevertheless, it reflects a regulatory trend worth watching.

The focus is beginning to shift from a purely reactive question — “What did the organization do after the attack?” — toward another question that may be more relevant from a legal standpoint: “What had the organization done before the attack to prevent it?”

That distinction may ultimately prove decisive when liability is assessed.

Cybersecurity is no longer just about firewalls, passwords, and servers. It is also about risk management, data protection, contracts, governance, and regulatory compliance.

If you are considering how these changes may affect your organization, feel free to contact me at manuel@pittaluga.com. I would be happy to discuss your specific situation.