Uruguay

Sets the functions of AGESIC's Dirección de Seguridad de la Información and the CERTuy, and applies to public entities and private entities linked to critical services or sectors (art. 2). Entities must report cyber incidents to the CERTuy within 24 hours of learning of them, in the form the CERTuy sets (art. 10 g). Promulgated 20 February 2025 and published 14 March 2025.

Art. 78 requires public entities and private entities tied to critical services or sectors (as defined in art. 149 of Ley 18.719) to protect critical information assets, name an information security officer, report possible cybersecurity incidents promptly and in full, and adopt AGESIC's cybersecurity framework. Promulgated 6 November 2023 and published 17 November 2023; Decreto 66/025 regulates the article.

Voluntary status for companies and trusts whose founding document states a purpose of positive, verifiable social and environmental impact; administrators must weigh effects on members, employees, communities and the environment (art. 4) and file a public annual impact report within six months of each year-end (art. 5). Promulgated 23 July 2021 and published 20 August 2021.

Requires controllers to start limiting the impact of a security incident within 24 hours of confirming it (art. 3) and to notify the URCDP of a breach within 72 hours of learning of it, telling data subjects significantly affected (art. 4). Promulgated 17 February 2020 and published 21 February 2020.

Defines the beneficial owner as a natural person holding at least 15% of capital or voting rights, or exercising final control (art. 22). The BCU keeps the registry of beneficial owners and of holders of nominative shares (art. 27) and the Auditoría Interna de la Nación checks compliance and applies sanctions (art. 28). Changes must be reported within 45 days, or 90 days where non-resident owners or chain members are involved (arts. 25 and 30). Promulgated 5 January 2017 and published 30 January 2017.

Sets customer due diligence (arts. 14 to 20), record-keeping (art. 21), confidentiality (art. 22) and suspicious-transaction reporting duties (arts. 12 and 13) for financial and non-financial obligated entities. Promulgated 20 December 2017 and published 10 January 2018. IMPO shows art. 13 reworded by Ley 20.469 of 19 March 2026 and art. 12 last amended by Ley 19.889; the other articles read carry no later amendment note.

Promulgated 11 September 2009 and published 21 September 2009; regulated by Decreto 256/017. Applies to the public and private sectors. Employers must prevent and sanction sexual harassment, protect complainants' privacy and publicise an anti-harassment policy (art. 6). Workers may complain internally or to the Inspección General del Trabajo y de la Seguridad Social (arts. 5 and 7 to 9). The affected worker and witnesses may not be dismissed or disciplined for their involvement, and measures within 180 days of a complaint are presumed retaliatory (art. 12).

Promulgated 11 September 2009 and published 30 September 2009. Establishes collective bargaining, creates the Consejo Superior Tripartito (arts. 7 to 10), provides for sector bargaining through the Consejos de Salarios or bipartite negotiation (art. 11), and gives the Ministry of Labour a mediation and conciliation role (arts. 18 to 20). Amended by Ley 19.027 (2012), which reworded art. 8, and by Ley 20.145 (17 May 2023), which added a paragraph to art. 4, reworded art. 14, repealed literal D of art. 10 and repealed paragraph 2 of art. 17.

Covers the securities market, its participants, trading venues, publicly offered securities and their issuers. Public offerings are allowed only for securities and issuers registered in the Securities Registry. Art. 8 names the Superintendencia de Servicios Financieros of the BCU as the body that issues the rules for the securities markets. Promulgated 2 December 2009 and published 16 December 2009.

Protects personal data, with consent as the basic lawful ground (art. 9), gives data subjects rights of access and rectification (arts. 14 and 15), creates the URCDP as control body (art. 31) and gives it sanctioning powers up to a fine of 500,000 indexed units (art. 35). Promulgated 11 August 2008 and published 18 August 2008; IMPO shows an updated text, regulated by Decreto 414/009.

Promulgated 27 December 2002 and published 31 December 2002. Art. 2, as reworded by Ley 20.446 (art. 715), requires a supervised entity to give the Superintendencia de Servicios Financieros prior notice before contracting third parties for services inherent to its business, lets the BCU set conditions by regulation, and subjects the providers to the same rules as the entity apart from sanctioning rules. Art. 3 treats retaliation against employees of supervised entities who report breaches to the BCU as an infraction and covers the report and the reporter's identity by the duty of secrecy.

Sets the BCU's nature, purposes and functions, including regulation and supervision of the payments and financial systems, and creates the Superintendencia de Servicios Financieros (arts. 36 to 38). Promulgated 30 March 1995 and published 17 April 1995; IMPO shows arts. 37 and 38 as reworded by Ley 20.446 of 16 December 2025.

Ends the Banco de Seguros del Estado's monopoly and lets people contract insurance with any authorised company; private insurers and reinsurers must be authorised by the Executive and operate from within Uruguay. Art. 2 provides for authorisation with the advice and control of the Superintendencia de Servicios Financieros of the BCU. Published 21 October 1993.

Covers private and non-state public entities that habitually intermediate money, securities or precious metals: authorisation, minimum capital, BCU supervision, sanctions, bank secrecy, liquidity assistance and administrative liquidation. Promulgated 17 September 1982 and published 23 September 1982; IMPO shows it as an updated text, amended several times, and regulated by Decreto 614/992. Art. 12 of Ley 19.574 sends penalties for unreported suspicious transactions to this decree-law.

Penal Code promulgated 4 December 1933, with the official version published in 1967 (Decreto 698/967). Art. 347 criminalises estafa (fraud): using artful stratagems or deceit to induce error and obtain an unjust benefit at another's expense, punishable by six months to four years of penitentiary imprisonment.