Personal data can only be transferred to a third party:

• for the compliance of purposes directly related to the legitimate interest of the transferring party and the transferee; and
• with the data subject's prior consent. Such consent may be revoked. Additionally, the data subject must be informed of the purpose of the transfer, the identity of the transferee, and the purposes for which the personal data will be used

The data subject's prior consent is not necessary if the individual’s data to be transferred is limited to: name, surname, identity card number, nationality, address, and date of birth.

The purpose and proper identification of the transferee must be included in the consent communication that would be addressed to the data subject. Evidence of the data subject’s consent must be kept in the files of the data processor.

If the data subject’s consent is not obtained within ten business days (counted from the receipt of the communication from the data processor asking for the consent), it will be construed that the data subject did not consent to the transfer of the data.

Upon the transfer, the data processor will remain jointly and severable liable for the compliance of the transferee obligations under the Data Protection Act.

The Data Protection Act forbids the transfer of personal data to countries or international entities which do not provide adequate levels of data protection (according to URCDP). However, the Data Protection Act allows international transfer to unsafe countries or entities, when the data subject consents to the transfer (such consent must be given in writing), or when the guarantees of adequate protection levels arise from “contractual clauses”, and “self regulation systems”. The international data transfer agreement must establish the same levels of protection which are effective under the laws of Uruguay.

In the case of a cross‑border transfer within a group of companies, Uruguayan laws establish that the international transfer will be lawful without any authorisation whenever the branch has the same conduct code duly registered before the local URCDP.

The international transfer of personal data between headquarters and their respective branches or subsidiaries is authorised when the headquarters and their branches have a conduct code duly filed before URCDP.