Last review date: 30 December 2024
Yes.
The following are potential legal bases for processing personal data:
☒ the data subject has provided consent to the processing for the identified purposes
☒ the personal data is necessary to perform a contract with the data subject
☒ the personal data is necessary to comply with a legal obligation
☒ other
Other legal bases stated in Law N° 18,331 (cases in which the data subjects' consent is not required) include the following:
- When the personal data is collected for the performance of government functions
- When the personal data is limited to:
- For natural persons: names, identity documents, nationality, address and date of birth
- For legal entities, the corporate name, brand name, tax identification number, address, phone number, and identity of the people in charge
- When the personal data is derived from a scientific or professional relationship of the data subject and is necessary for its development or execution
- When the processing is conducted by natural persons for their own personal and domestic use
Last review date: 30 December 2024
☒ Yes
The following are potential legal bases for processing special categories of personal data:
☒ the data subject has given consent to the processing, where consent is measured to a higher standard than for non-sensitive personal data (for example, additional requirement for consent to be "explicit")
☒ processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
☒ processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and further conditions
☒ processing is necessary for the establishment, exercise or defense of legal claims
☒ processing is necessary for the purposes of medicine, the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
☒ other
Sensitive data can only be collected and processed when there are reasons of general interest, which must be authorized by law, or when the requesting body has a legal mandate to do so.
Last review date: 30 December 2024
Yes.
A minor within the meaning of data privacy laws is a person below the age of 18.
Last review date: 30 December 2024
☒ generally
Last review date: 30 December 2024
☒ consent must be given or authorized by the holder of parental responsibility over the child
The Code on Childhood and Adolescence (Código de la Niñez y la Adolescencia) provides that the Uruguayan Institute for Children and Adolescents (Instituto Nacional del Niño y Adolescente del Uruguay, INAU) will serve as the guardian of the information contained in the National Information System on Childhood. Consequently, INAU must ensure the confidential and reserved use of the personal information of each child or adolescent in that Registry, in accordance with the best interests of the child and the right to privacy, recognizing that the sole owner of their personal history is the child or adolescent.
☒ other
Decree N° 64/020 mandates that a privacy impact assessment be conducted when processing personal data of groups with special vulnerabilities, particularly minors or people with disabilities.