Ley N° 18.331, cross border transfer of personal data

Ley N° 18.331, art. 23 (transferencia internacional de datos personales)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Transfer personal data outside Uruguay only to a country or organization that provides an adequate level of protection under international or regional legal standards, unless one of the law's listed exceptions applies (judicial cooperation, medical necessity, banking or stock-exchange transactions, an applicable treaty, or law-enforcement intelligence cooperation).
Absent an adequate-protection finding, transfer personal data internationally only with the data subject's unambiguous consent, under a contractual-necessity exception, or after the Unidad Reguladora y de Control de Datos Personales authorizes the transfer based on the contractual safeguards you offer.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 23 prohibits transferring personal data of any kind to a country or international body that does not provide an adequate level of protection under international or regional legal standards.

That prohibition does not reach judicial cooperation, medical-data exchange for public health reasons, banking or stock-exchange transactions, a treaty Uruguay is party to, or intelligence cooperation against organized crime, terrorism, or drug trafficking, and it also yields where the data subject unambiguously consents, the transfer is contractually necessary, an important public interest or a legal proceeding requires it, the data subject's vital interest is at stake, or the transfer comes from a register meant to inform the public.

Absent an adequate-protection finding and outside those exceptions, the Unidad Reguladora y de Control de Datos Personales may still authorize a transfer, or a series of transfers, to a country that does not guarantee an adequate level of protection where the controller offers sufficient contractual safeguards for privacy and fundamental rights.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Ley N 18.331 de 11 de agosto de 2008, texto consolidado, Direccion Nacional de Impresiones y Publicaciones Oficiales (IMPO)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app