Uruguay has not appended the WTO Telecom Reference Paper to its schedule of commitments.

It is reported that the Communications Services Regulatory Unit (URSEC), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process. In accordance with national legislation (Law 17.296), the URSEC has been established as a decentralised and autonomous public entity.

Pursuant to Art. 3 of Decree No. 92/014, the computer systems of the Central Administration are required to be housed within secure data centres located in Uruguay, except in instances where the associated public entity is not exposed to risk, as determined by specific guidelines outlined in the aforementioned Decree. Accordingly, unless such risk is absent, public entities forming part of the Central Administration must retain their data within the national territory. The guidelines in question establish general requirements pertaining to infrastructure and operational standards, including telecommunications systems, architectural design, electrical and mechanical systems, access control and security measures, system monitoring, service availability, and service level provisions.

According to Art. 35.1.1 of Circular No. 2419/2022 of the Central Bank of Uruguay, institutions of financial intermediation regulated by the Central Bank of Uruguay (BCU) or the Superintendence of Financial Services must obtain express authorisation from the Superintendence when outsourcing services to third parties located abroad. Express authorisation is also required when the third party is located in Uruguay, but the outsourced service is provided wholly or partially in or from abroad.
The authorisation request must include the draft service contract and a risk assessment report covering the risks associated with the outsourcing arrangement, including the financial and technical solvency of the provider and subcontractors, as well as legal risks affecting information subject to secrecy under Uruguayan law.
In this regard, the BCU has maintained that cloud computing services may be classified as a form of data processing outsourcing. Consequently, in order for a financial services institution to engage the services of a foreign cloud computing provider, it must first submit a formal request for authorisation to the BCU. In addition, the financial institution is obliged to establish a local data backup or maintain a unified access point on its premises (Art. 35.3).

Art. 23 of Law No. 18.331 stipulates that international transfers of personal data are permissible only where the recipient country or international organisation ensures a level of protection deemed adequate by the Uruguayan Data Protection Authority (URCDP). Transfers to jurisdictions lacking such adequacy may proceed solely under the statutory exceptions or with prior authorisation from the URCDP. The law provides the following exceptions:
- international judicial cooperation under an applicable treaty or convention;
- exchange of medical data where necessary for the treatment of the data subject or for public health purposes;
- banking or stock exchange transfers relating to the relevant transactions and in compliance with applicable legislation;
- agreements concluded within the framework of international treaties to which Uruguay is a party;
- cooperation between intelligence agencies to combat organised crime, terrorism, and drug trafficking;
- where the data subject has given unequivocal consent to the transfer;
- where the transfer is necessary for the performance of a contract with the data subject or for pre-contractual measures at their request;
- where the transfer is necessary for the conclusion or performance of a contract in the data subject’s interest between the controller and a third party;
- where the transfer is necessary or legally required to safeguard an important public interest or for the establishment, exercise, or defence of legal claims;
- where the transfer is necessary to protect the vital interests of the data subject; and
- where the transfer originates from a public register established by law for public consultation, provided the legal conditions for such consultation are met.
The URCDP maintains a list of jurisdictions and organisations recognised as providing adequate protection. These include: the Member States of the European Union and the European Economic Area; Andorra; Argentina; the Canadian private sector; Guernsey; the Isle of Man; the Faroe Islands; Israel; Japan; Jersey; New Zealand; the United Kingdom; Switzerland; organisations listed under the U.S. Department of Commerce Data Privacy Framework; and entities subject to the Republic of Korea’s Personal Information Protection Act.

Uruguay is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

According to Art. 2 of the Investment Promotion and Protection Law 16906, the State of Uruguay establishes equal treatment in the regime of admission and treatment of investments made by foreign and domestic investors.

Uruguay is a party to the Patent Cooperation Treaty (PCT).

Uruguay has a copyright regime under the Law No. 9.739. However, the exceptions do not follow the fair use or fair dealing model, therefore limiting the lawful use of copyrighted work by others. Art. 45 lists the exceptions, which include the publication of works intended for teaching, excerpts, fragments of poetry, and single articles, provided that the author's name is indicated; Publication of works intended for teaching, excerpts, fragments of poetry, and single articles, provided that the author's name is indicated; dissemination of news, reports, and journalistic information as long as their exact version is maintained and their origin is expressed; among others.

Copyright is not adequately enforced online in Uruguay. It is reported that 37% of broadband households in the country consume online piracy. In addition, an estimated 56% of the population consumes illegal online streaming services, and 18% of households consume illegal pay-TV.

Uruguay has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.

Uruguay has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Uruguay lacks a comprehensive framework in place that provides effective protection of trade secrets, but there are limited measures addressing some issues related to them.
In particular, Uruguayan law protects confidential commercial information through a range of instruments, including rules on public information and administrative confidentiality, and it recognises limits on compelled disclosure of commercially sensitive information, such as trade secrets and know-how, in certain regulatory contexts.
Art. 10 of Law No. 18.381 classifies as confidential commercial, industrial, scientific, and technical information whose disclosure could harm a party’s competitive position. Moreover, Art. 14 of Law No. 18.159 provides that requests for information by the competition authority do not create an obligation to disclose trade secrets, know-how, inventions, formulas, or patents.
In addition, the Penal Code, Law No. 9.155 of contains limited provisions on the protection of secrecy. Arts. 300–302 criminalise the fraudulent access to secret public or private documents, the disclosure without just cause of secret documents obtained through fraudulent or otherwise unlawful means, and the disclosure without just cause of secrets known by reason of profession, employment or commission, where harm is caused.

It is reported that passive sharing of infrastructure in the telecom market is not mandated, though it is practised in the mobile sector based on commercial agreements. In contrast, in the fixed sector, passive sharing is neither mandated nor practised.

Pursuant to Art. 1 of Law 14,235, the National Telecommunications Administration of Uruguay (ANTEL) is a decentralised public service, and the company is fully state-owned.