Law / Uruguay

Ley N° 18.331, rights of data subjects

Ley N° 18.331, arts. 13-17 y 21, según Ley N° 20.075, de 2022, y Ley N° 18.719, de 2010 (derechos de los titulares de los datos)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before or when you collect personal data, tell the data subject expressly, precisely, and unambiguously the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, the consequences of refusing or of inaccuracy, their rights of access, rectification, and challenge, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.
Give a data subject free access, at most every six months, to all information about them held in your database, supplied within five business days, in clear language, covering the whole record without revealing a third party's data.
Correct, update, include, or delete a data subject's personal data within five business days of their request when it is erroneous, false, or missing, or explain in writing why it does not, and notify any recipient of the data of the correction within five business days.
Let a data subject challenge, and obtain the valuation criteria and the program behind, any administrative act or private decision based solely on automated processing of their personal data that offers an assessment of their character or personality.
On request, remove or block a data subject's data from a marketing, canvassing, or profiling database at any time, free of charge.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 13, as rewritten by Ley N° 20.075 art. 62, requires telling a data subject, before or when their data is collected, the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, particularly for sensitive data, the consequences of refusing or of inaccuracy, the rights available under articles 14 to 16, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.

Article 14 gives a data subject free access, at most every six months, to all information about them held in a public or private database, supplied within five business days in clear language, covering the whole record without revealing a third party's data.

Article 15 gives a right to rectification, updating, inclusion, or deletion of erroneous, false, or missing personal data, to be carried out within five business days of the request or explained in writing, with any recipient of the data notified of the change within five business days.

Article 16 lets a data subject challenge, and obtain the valuation criteria and the program behind, any administrative act or private decision based solely on automated processing of their personal data that offers an assessment of their character or personality. Article 17 conditions communicating personal data to a third party on the data subject's prior consent and on notice of the purpose and the recipient.

Article 21 lets a data subject request, at any time and free of charge, the withdrawal or blocking of their data from a marketing, canvassing, or profiling database.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Ley N 18.331 de 11 de agosto de 2008, texto consolidado, Direccion Nacional de Impresiones y Publicaciones Oficiales (IMPO)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app