Law No. 18,331 (2008) – Personal Data Protection and Habeas Data Act; establishes the general legal framework for the processing and protection of personal data.

Decree No. 414/009 (2009) – Regulatory decree implementing Law No. 18,331, setting out operational rules for data processing, database registration, security measures, and international transfers.

Law No. 19,670 (2018) – Introduced updates to the data protection regime, including the regulation of personal data breaches and the concept of data portability.

Decree No. 64/020 (2020) – Regulates the obligation to notify personal data security incidents (data breach notification).

URCDP Resolutions and Guidelines – Complementary regulatory criteria issued by the data protection authority on matters such as international data transfers, security standards, and compliance obligations.