Under Law No. 18,331, the communication or transfer of personal data to third parties must be consistent with the purposes for which the data was originally collected and generally requires the prior consent of the data subject, unless a statutory exception applies. The recipient of the data is bound by the same legal and confidentiality obligations as the data controller.

With regard to international transfers, personal data may be transferred to jurisdictions that provide an adequate level of protection, or where appropriate safeguards or legal exceptions apply.

Notably, European Commission recognized Uruguay as a jurisdiction providing an adequate level of protection for personal data in 2012, which facilitates the lawful transfer of personal data from the European Union to Uruguay.