What Is Ley N.º 18.331, Ley de Protección de Datos Personales y Acción de Habeas Data?
Uruguay's Ley N.º 18.331, promulgated 11 August 2008 and published 18 August 2008, is implemented by Decreto N.º 414/009 (2009) and supervised by the Unidad Reguladora y de Control de Datos Personales (URCDP). Ley N.º 19.670 (2018) added a territorial-scope rule applying the law to processing by a controller/processor established in Uruguay and, in specified cases, to entities not established there (offering goods/services to residents, analyzing their behavior, or using means located in Uruguay). Access is free at six-month intervals (absent a new legitimate interest) and must be supplied within five business days; an unsatisfied or unjustifiably denied request enables the habeas data judicial action. Rectification, updating, inclusion, or suppression requests must be acted on or explained within five business days. For advertising, commercial-prospecting, and similar databases, Article 21 lets a person request removal or blocking at any time, free of charge — the closest located route for a data-broker or marketing-list scenario. URCDP publishes access and rectification/suppression forms and an online complaint trámite (no cost). This is a source-backed evidence profile. The primary legal and regulator sources are in Spanish; no official English translation was located. No separate Uruguay data-broker registry or central opt-out portal was located.
At a glance
- Full name
- Ley N.º 18.331, Ley de Protección de Datos Personales y Acción de Habeas Data
- Short code
- Uruguay Ley 18.331
- Jurisdiction
- Uruguay
- Enacted
- 2008
- Last major update
- Amended by Ley N.º 18.719 (2010), 19.355 (2015), 19.438 (2016), 19.670 (2018, territorial scope), and 20.075 (2022); implementing Decreto N.º 414/009 (2009)
- Regulator
- Unidad Reguladora y de Control de Datos Personales (URCDP)
- Private right of action
- Yes
- Statutory citation
- Ley N.º 18.331 (2008), as amended
Scope, who Uruguay Ley 18.331 covers
Protected data
Data subject rights
Information before collection about purpose, recipients, controller identity, and whether answers are mandatory (Article 13)
Access to one’s own data in public or private databases, free at six-month intervals, supplied within five business days (Article 14)
Rectification, updating, inclusion, or suppression for error, falsity, or exclusion, acted on or explained within five business days (Article 15)
Right not to be subject to a significantly affecting decision based solely on automated processing, with a right to challenge and obtain evaluation-criteria information (Article 16)
Removal or blocking from advertising/commercial-prospecting/sales databases, at any time and free of charge (Article 21)
Habeas data judicial action where a request is denied or the deadline expires (Article 37)
Notable features
Article 21’s free, at-any-time removal/blocking right for advertising and commercial-prospecting databases is one of the more directly broker-relevant provisions found across this research batch, though it remains subject to the statute’s own scope and exceptions.
Enforcement & penalties
Regulator: Unidad Reguladora y de Control de Datos Personales (URCDP)
Penalties: The reviewed IMPO and URCDP materials for this research pass focused on rights, request timelines, and the complaint trámite rather than a consolidated fine schedule; check Ley 18.331’s sanction provisions directly before publishing a penalty figure.
Private right of action: Article 37 provides the habeas data judicial action where a request is denied, unsatisfied, or the response deadline expires, in addition to URCDP’s no-cost administrative complaint trámite.
Relevance to data brokers
No separate Uruguay data-broker registry or central opt-out portal was located. The supported route for a marketing or advertising database is to identify the controller and use the Article 21 access/removal-or-blocking request; if unresolved, URCDP’s complaint route and the habeas data remedy are the located escalation paths.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Can I get removed from a marketing database in Uruguay?+
Article 21 lets a person request removal or blocking from advertising, commercial-prospecting, sales, and similar databases at any time, free of charge, subject to the statute’s scope and exceptions.
What happens if a Uruguayan controller ignores my access request?+
You may bring the habeas data judicial action under Article 37, in addition to URCDP’s no-cost administrative complaint trámite.
Official sources & citations
Other international privacy regimes
Uruguay Ley 18.331 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: