Uruguay has issued Decree 64/020, regulating the 2018 and 2019 amendments to Law No. 18,331 on personal data protection and bringing the regime closer to the GDPR.
Key points
- Breaches must be notified to the URCDP within 72 hours.
- A DPO is required for certain entities.
- Introduces privacy by design.
- Clarifies extraterritorial application.
- Applies to entities outside Uruguay offering goods or services to Uruguayan residents.
Uruguay holds EU and UK adequacy. UK organisations with Uruguayan operations, or targeting Uruguayan residents, should update their breach and governance procedures.
Source: Decreto N° 64/020 (IMPO)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
