Personal Data Protection and Habeas Data Action Law

Uruguay holds a European Commission adequacy decision (2012) and, unusually for the region, added explicit GDPR-style extraterritoriality after the fact: Law 19.670 (Arts. 37-40) extends the regime to controllers and processors outside Uruguay that offer goods or services to people in Uruguay or monitor their behavior, and Decree 64/020 fleshed out breach notification, data-protection officers, and impact assessments. Database registration with the Unidad Reguladora y de Control de Datos Personales (URCDP) is required. The combination — small market, adequacy status, real extraterritorial reach — means a business serving Uruguayan customers can be in scope without any local footprint.