The framework
Uruguay's framework rests on Law 18.331 on Personal Data Protection, adopted in 2008, with the URCDP as the supervisory authority.
That puts Uruguay in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law 18.331 on Personal Data Protection
The region's quiet overachiever: EU adequacy since 2012, Convention 108+ membership, and steady GDPR-style upgrades bolted onto its 2008 law.
Marketing and advertising
Consent-first with GDPR-style updates layered in since 2018 (breach notification, DPOs, impact assessments). That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad require an adequate destination, and Uruguay itself holds an EU adequacy decision.
Enforcement and penalties
Administrative fines apply, alongside registry sanctions. Read the ceiling together with the authority's track record, which prices the risk.