← Global Privacy Laws Research Library
Law No. 18.331
Ley No. 18.331 - Protección de Datos Personales y Acción de Habeas Data
Uruguay Personal Data Protection Law No. 18.331
Prepared by Shubhank Suman · Last reviewed
Enacted annotated text; present consolidation not independently verified
- Legal character
- National statute
- Region
- Latin America
- Promulgated
- 11 August 2008
- Published
- 18 August 2008
What it covers
Personal-data protection as a fundamental right, principles, access and correction, challenges to automated evaluations, communication of data, specially protected data, overseas transfers, database obligations, regulatory oversight and habeas data proceedings.
Why it matters
Article 16 directly protects individuals against significant automated evaluations and provides information about evaluation criteria and the programme used. The uploaded annotations must not be mistaken for the untouched 2008 wording.
Refer to it when
Research Uruguay’s personal-data rights, automated credit/employment evaluations, sensitive data, transfers, database registration or habeas data.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
Article 16 addresses automated evaluation with significant legal effects and access to evaluation criteria/programme information. Not a general AI framework.
Privacy
VERY HIGH
Principles, rights, transfers and judicial redress.
Cybersecurity
HIGH
Security and confidentiality principles.
Applicability
Public and private personal-data databases and processing within articles 2-4, with domestic-use and other statutory exclusions. Special public/security-sector provisions require separate reading.
Read first
Articles 2-4 → 5-17 → 18-23 → 24-36 → 37 onward.
Provisions / sections covered
Articles 1-12 - Scope and principles
Application and definitions, legality, accuracy, purpose, informed consent and exceptions, security, confidentiality and accountability.
Articles 13-17 - Rights and communications
Information, access, rectification/deletion and article 16 automated-evaluation challenges. Article 17 regulates communications and recipient obligations; it is not the registration provision.
Articles 18-23 - Protected categories and transfers
Sensitive, health, telecommunications and commercial/credit data; article 23 restricts transfers to destinations without adequate protection, subject to specified exceptions and mechanisms.
Articles 24-36 - Databases and oversight
Public/private databases, database obligations and the independent control body. Article 29 addresses private database registration; article 34 sets out the control body’s functions.
Articles 37 onward - Habeas data
Judicial action and procedural safeguards for access to personal data and protection of the corresponding rights.
Subject-matter tags
- Consent
- Sensitive data
- Data subject rights
- Erasure and deletion
- Cross-border transfers
- Employment data
- Registration and notification
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.