Uruguay has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

The Consumer Relations and Consumer Defense Law provides a comprehensive consumer protection framework that applies to online transactions. The law covers competition, product and user safety, environmental concerns, and financial regulations.

Uruguay has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

In accordance with Art. 9 of the Technical Instructions: Registration of Names under the ".UY" Domain, the applicant for a domain name registration must communicate the registered address of the holder(s) and the address in Uruguay for contractual and extra-contractual purposes of these instructions.

Decree No. 356/014 sets some rules regarding the de minimis threshold, which is the minimum value of goods below which customs do not charge duties. According to Arts. 3-4 of the Decree, the de minimis threshold applied to a purchase by non-express mail is equal to USD 50, while for purchases by express mail it is equal to USD 200. Moreover, the de minimis applies under certain conditions: only up to 3 purchases per year, for non-commercial purposes, by a natural person of legal age with a valid Uruguayan identity card and when the gross weight of the items does not exceed 20 kilograms.

It is reported that in the State of Uruguay self-declaration of conformity is not allowed for foreign companies for any radio transmitting devices, such as cellular exchanges, radio alarm devices, wireless remote controls, wireless microphones, cellular phones, cordless phones, radio communications transceiver equipment, wireless network cards, wifi/bluetooth transmitter devices, drone transceivers, etc. However, approvals in Uruguay are regulated by the Regulatory Unit of Communications Service (URSEC). The URSEC issues a certificate of approval of radio equipment based on the equipment certified by the FCC. The approvals, once obtained, are valid for 15 years. Typically, approvals can be obtained in less than 10 weeks without the need for in-country testing.

It is reported that a basic legal framework on intermediary liability beyond copyright infringement is absent in Uruguay's law and jurisprudence.

It is reported that Uruguay imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card, or a passport in case of foreigners, to activate a new prepaid SIM card.

It is reported that a basic legal framework on intermediary liability for copyright infringement is absent in Uruguay's law and jurisprudence.

According to Art. 6 of Decree 64/2020, prior to the start of the processing, the controller and the processor shall carry out an assessment of the impact on the protection of personal data (DPIA) in certain circumstances.
According to Art. 10, the controller and the processor shall carry out an assessment of the DPIA, when the processing operations may:
- Use sensitive data as a core business.
- Project permanent or stable processing of the specially protected data referred to in Chapter IV of Law No. 18.331 of August 11, 2008, or of data related to the commission of criminal, civil, or administrative offenses.
- Involve an evaluation of personal aspects of the data subjects to create or use personal profiles, in particular by analyzing or predicting aspects related to their work performance, economic situation, health, personal preferences or interests, behavioral reliability, behavioral reliability, financial solvency, and location.
- To process data of groups of persons in a situation of special vulnerability and, in particular, of minors or persons with disabilities.
- Processing of large volumes of personal data.
- Transfer of personal data to other States or international organizations for which there is no adequate level of protection.
- Others determined by the Regulatory and Control Unit of Personal Data.

According to the Art. 40 of Law No 19,670 the appointment of a Data Protection Officer (DPO) is mandatory in the following cases: (i) public state or non-state entities, (ii) private or partially state-owned entities, (iii) private entities which process sensitive data as a core activity, and (iv) private entities which process large scales of data (Art. 10 of Decree 64/2020 establishes that large scales of data mean the data processing of more than 35,000 data subjects).

The appointment of a DPO must be submitted to the approval of the Regulatory Unit for the Control of Personal Data (URCDP). If the legal and technical requirements are not met, the Regulator is empowered to refuse or revoke (as the case may be) the submission/authorization to the appointed DPO, as set forth in Resolution No. 32/20. The delegate is responsible for advising the organizations they represent on compliance with the rules set forth in Law No. 18,331 on Personal Data Protection. In addition to this, they are also responsible for serving as the main point of contact with the URCDP, along with several other functions.

Uruguay has a data protection framework established in Law No. 18.331 - Personal Data Protection Law.

According to Art. 23 of Law No. 18.331 - Personal Data Protection Law, the transfer of personal data to countries or international organizations that do not provide adequate levels of protection is prohibited. The prohibition shall not apply in the case of:
- International judicial cooperation, in accordance with the respective international instrument, whether Treaty or Convention, takes into account the case's circumstances;
- Exchange of medical data when so required by the affected person's treatment for public health or hygiene reasons;
- Banking or stock exchange transfers, in relation to the respective transactions and in accordance with the applicable legislation;
- Agreements within the framework of international treaties to which the Oriental Republic of Uruguay is a party;
- International cooperation between intelligence agencies in the fight against organized crime, terrorism fight against organized crime, terrorism, and drug trafficking.

Uruguay has committed to open the transfer of cross-border data flows as part of the Free Trade Agreement between the Republic of Chile and the Oriental Republic of Uruguay.
In addition, the country has joined several trade agreements considered relevant to digital trade:
- Partial Scope Agreement Of Economic Complementation No. 57 Signed Between The Argentine Republic And The Oriental Republic Of Uruguay.
- Free Trade Agreement between the Oriental Republic of Uruguay and the Government of the United Mexican States.
- Economic Complementation Agreement signed between the Governments of the Argentine Republic, the Federative Republic of Brazil, the Republic of Paraguay and the Oriental Republic of Uruguay, Member States of Mercosur, and the Governments of the Republic of Colombia, the Republic of Ecuador and the Bolivarian Republic of Venezuela, Member Countries of the Andean Community.
- Economic Complementation Agreement subscribed between the Governments of the Republic of Argentina, the Federative Republic of Brazil, the Republic of Paraguay, the Oriental Republic of Uruguay, Mercosur Member States, and the Government of the Republic of Peru.
- Partial Scope Agreement between the Oriental Republic of Uruguay and the Bolivarian Republic of Venezuela.

Uruguay has not appended the WTO Telecom Reference Paper to its schedule of commitments.