Ley N° 18.331, sensitive personal data and health data

Ley N° 18.331, de 2008, arts. 4 (literal E), 18 y 19 (datos sensibles y datos relativos a la salud)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not require anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life), and process what you do collect only with the data subject's express written consent.
Collect and process sensitive data absent that consent only where an interest-general law authorizes it, the requesting body has a legal mandate to do so, or the purpose is statistical or scientific and the data is disassociated from its subject.
Do not build a database whose content directly or indirectly reveals sensitive data, unless you are a political party, union, church, or other nonprofit body processing only your own members' sensitive data for your own political, religious, or similarly aligned purpose, and even then never communicate it further without the member's consent.
If you are a health establishment or a health professional, collect and process a patient's physical or mental health data only under the rules of professional secrecy and the applicable health-sector regulations.

What it reaches

Obligation class

Prohibition, Consent

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 18 bars requiring anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life, as article 4 literal E defines it), and permits its processing only with the data subject's express written consent.

Absent that consent, article 18 allows collection and processing only where an interest-general law authorizes it or the requesting body has a legal mandate, or for statistical or scientific purposes once the data is disassociated from its subject.

Article 18 also bars forming a database whose content directly or indirectly reveals sensitive data, except for a political party, union, church, or other nonprofit body that processes only its own members' data for its own political, religious, or similarly aligned purpose, and never without the member's consent to any further communication of that data.

Article 19 lets a public or private health establishment or a health professional collect and process a patient's physical or mental health data only under the rules of professional secrecy and the specific health-sector regulations, alongside this law.

When LexLint raises it

crawls_web
trains_models
handles_health_records

Read the law

Ley N 18.331 de 11 de agosto de 2008, texto consolidado, Direccion Nacional de Impresiones y Publicaciones Oficiales (IMPO)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app