Ley 18.331 de Proteccion de Datos Personales — international transfer of personal data

Art. 23 prohibits transferring personal data to countries or international organisations that do not provide adequate levels of protection, unless one of the listed exceptions applies. Uruguay is one of the few Latin American jurisdictions holding an EU adequacy decision, so transfers in the other direction are unrestricted from the EU's side — but that is not reciprocal, and Uruguay's own outbound restriction still binds. The URCDP has issued guidance on drafting contractual clauses for transfers to non-adequate countries, which is the practical route where no adequacy finding covers the destination. Marked 'check': the operative texts are Spanish-language and the URCDP's guidance instruments were triangulated across independent legal-reference sources rather than read in the original.