Law No. 18,331 on Data Protection: Uruguay´s Comprehensive Framework for Protecting Personal Data

By Pittaluga Abogados

Law No. 18,331 on Data Protection (the "Data Protection Law") is Uruguay's comprehensive framework for protecting personal data. The law was enacted in 2008 and on August, 2023, the Government organized an international event to celebrate its 15 year anniversary.

It applies to all natural and legal persons, public or private, who process personal data in Uruguay, regardless of whether the processing is carried out electronically or manually.

The Data Protection Law defines personal data as any information that can identify a natural person, directly or indirectly. This includes information such as name, address, telephone number, email address, date of birth, and social security number. The law also protects sensitive personal data, such as information about health, race, ethnicity, religion, and political affiliation.

The Data Protection Law establishes a number of principles that must be followed when processing personal data. These principles include:

-Legality: Personal data must be processed lawfully, fairly, and transparently.

-Purposefulness: Personal data must be collected and processed for specific, legitimate, and explicit purposes.

-Data adequacy: Personal data must be adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

-Accuracy: Personal data must be accurate and up-to-date.

-Storage limitation: Personal data must be stored only for the time necessary to achieve the purposes for which it was collected.

-Integrity and confidentiality: Personal data must be processed in a manner that ensures its security and confidentiality, including protection against unauthorized access, use, disclosure, alteration, or destruction.

The Data Protection Law also grants individuals a number of rights with respect to their personal data. These rights include the right to access their personal data, the right to rectify inaccurate or incomplete personal data, the right to erase their personal data, and the right to restrict the processing of their personal data.