Uruguay Law 18.331

Uruguay Personal Data Protection Law - URCDP oversight, GDPR adequacy, data subject rights.


Short name	UY 18331
Region	Americas
Country or scope	Uruguay
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers UY 18331

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for UY 18331.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for UY 18331 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`UY-18331-10` Data Security Measures	Those responsible for databases must adopt the measures necessary to guarantee the security and confidentiality of personal data and prevent its adulteration, loss or unauthorised access, which for software includes verifiable component integrity (Law 18.331 Art. 10)	Scan
`UY-18331-REG` Database Registration with URCDP	Databases must be registered with the supervisory authority with identifying descriptions of the processing, requiring identifiable, dated documentation of the processing environment (Law 18.331 database registration provisions)	Scan
`UY-18331-QUAL` Data Quality (Veracity) Principle	Personal data must be truthful, adequate and up to date; a processing environment can only evidence this discipline if its own software inventory is complete with names and versions (Law 18.331 veracity/data quality principle)	Scan
`UY-18331-PROC` Processing on Behalf of Third Parties	Processing entrusted to third parties must preserve the security and confidentiality obligations of the law, which extends to recording the suppliers of software components used in processing (Law 18.331 third-party processing provisions)	Scan
`UY-18331-BREACH` Security Incident Notification Readiness	Regulatory updates require notifying the URCDP of security incidents affecting personal data, which requires the ability to identify precisely which components were involved (Decree 64/020 breach notification requirements under Law 18.331)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`UY-7`	Data Quality Principles
`UY-11`	Consent & Lawful Basis
`UY-13`	Special Categories Prohibitions & Exceptions
`UY-23`	Data Subject Rights Procedures
`UY-28`	Security Obligations
`UY-31`	International Transfer Controls
`UY-URCDP`	URCDP Database Registration
`UY-PROC`	Data Processor Contracts
`UY-DPO`	Privacy Accountable Person

Policy templates

Written for UY 18331:

Uruguay Data Subject Rights (ARCO) Procedure
Uruguay URCDP Database Registration Procedure

And 22 from the standard set, adapted to UY 18331.