According to the Art. 40 of Law No 19,670, the appointment of a Data Protection Officer (DPO) is mandatory in the following cases: (i) public state or non-state entities, (ii) private or partially state-owned entities, (iii) private entities which process sensitive data as a core activity, and (iv) private entities which process large scales of data (Art. 10 of Decree 64/2020 establishes that large scales of data mean the data processing of more than 35,000 data subjects).
The appointment of a DPO must be submitted to the Regulatory Unit for the Control of Personal Data (URCDP) for approval. If the legal and technical requirements are not met, the Regulator is empowered to refuse or revoke (as the case may be) the submission/authorisation to the appointed DPO, as set forth in Resolution No. 32/20. The delegate is responsible for advising the organisations they represent on compliance with the rules set forth in Law No. 18,331 on Personal Data Protection. In addition, they serve as the main point of contact with the URCDP, among other functions.

According to Art. 6 of Decree 64/2020, prior to the start of processing, the controller and the processor shall, in certain circumstances, carry out an assessment of the impact on the protection of personal data (DPIA).
According to Art. 10, the controller and the processor shall assess the DPIA when the processing operations may:
- Use sensitive data as a core business.
- Project permanent or stable processing of the specially protected data referred to in Chapter IV of Law No. 18.331 of August 11, 2008, or data related to the commission of criminal, civil, or administrative offences.
- Involve an evaluation of personal aspects of the data subjects to create or use personal profiles, in particular by analysing or predicting aspects related to their work performance, economic situation, health, personal preferences or interests, behavioural reliability, financial solvency, and location.
- To process data of groups of persons in a situation of special vulnerability and, in particular, of minors or persons with disabilities.
- Processing of large volumes of personal data.
- Transfer of personal data to other States or international organisations for which there is no adequate level of protection.
- Others determined by the Regulatory and Control Unit of Personal Data.

It is reported that a basic legal framework on intermediary liability for copyright infringement is absent in Uruguay's law and jurisprudence.

It is reported that a basic legal framework on intermediary liability beyond copyright infringement is absent in Uruguay's law and jurisprudence.

According to Arts. 1 and 2 of Decree No. 274/014, mobile service providers must maintain an up-to-date register of individuals or legal entities contracting prepaid or postpaid services. Additionally, individuals or legal entities wishing to contract for these services are required to provide the identification data specified in Art. 4, including the subscriber's name, legal identification document, and address.

Art. 12 of the Regulation approved by Decree No. 292/024, requires prior authorisation from the Ministry of Environment for the importation of used general-use electrical and electronic equipment and used components intended for reuse, commercialisation, repair or reconditioning. The Regulation defines the covered equipment functionally rather than by HS code, and the Ministry’s implementing classification includes monitors, screens and small information-technology and telecommunications equipment.

It is reported that self-declaration of conformity (SDoC) is not allowed for foreign companies for any radio transmitting devices, such as cellular exchanges, radio alarm devices, wireless remote controls, wireless microphones, cellular phones, cordless phones, radio communications transceiver equipment, wireless network cards, wifi/bluetooth transmitter devices, drone transceivers, among others. The approvals in Uruguay are regulated by the Regulatory Unit of Communications Service (URSEC). The approvals, once obtained, are valid for 15 years. Typically, approvals can be obtained in less than 10 weeks without in-country testing.

Uruguay has not appended the WTO Telecom Reference Paper to its schedule of commitments.

It is reported that the Communications Services Regulatory Unit (URSEC), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process. In accordance with national legislation (Law 17.296), the URSEC has been established as a decentralised and autonomous public entity.

Pursuant to Art. 3 of Decree No. 92/014, the computer systems of the Central Administration are required to be housed within secure data centres located in Uruguay, except in instances where the associated public entity is not exposed to risk, as determined by specific guidelines outlined in the aforementioned Decree. Accordingly, unless such risk is absent, public entities forming part of the Central Administration must retain their data within the national territory. The guidelines in question establish general requirements pertaining to infrastructure and operational standards, including telecommunications systems, architectural design, electrical and mechanical systems, access control and security measures, system monitoring, service availability, and service level provisions.

According to Art. 35.1.1 of Circular No. 2419/2022 of the Central Bank of Uruguay, institutions of financial intermediation regulated by the Central Bank of Uruguay (BCU) or the Superintendence of Financial Services must obtain express authorisation from the Superintendence when outsourcing services to third parties located abroad. Express authorisation is also required when the third party is located in Uruguay, but the outsourced service is provided wholly or partially in or from abroad.
The authorisation request must include the draft service contract and a risk assessment report covering the risks associated with the outsourcing arrangement, including the financial and technical solvency of the provider and subcontractors, as well as legal risks affecting information subject to secrecy under Uruguayan law.
In this regard, the BCU has maintained that cloud computing services may be classified as a form of data processing outsourcing. Consequently, in order for a financial services institution to engage the services of a foreign cloud computing provider, it must first submit a formal request for authorisation to the BCU. In addition, the financial institution is obliged to establish a local data backup or maintain a unified access point on its premises (Art. 35.3).

Art. 59 of the Consolidated Text on Accounting and Financial Administration (TOCAF) establishes the Public Procurement Program for Development, which authorises the use of special procurement regimes and procedures to support domestic suppliers, particularly micro, small, and medium-sized enterprises (MSMEs).
Within this framework, instruments such as price-preference margins and market-reservation mechanisms may be applied in favour of domestic producers and suppliers. The price preference margin may reach up to twice the margins established in Art. 58 (which go from 8% to 16%), while procurement reserved for the market may not exceed 10% of the total contracts and purchases of the same agency in the relevant fiscal year. Art. 60 further provides that the program shall include, inter alia, a Subprogram for Public Procurement for Scientific and Technological Development and Innovation, coordinated by the National Agency for Research and Innovation.
Decree No. 371/010, which regulates the Public Procurement Subprogramme for the Development of MSMEs, further operationalises this framework by setting eligibility conditions.

Uruguay is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

According to Art. 2 of the Investment Promotion and Protection Law 16906, the State of Uruguay establishes equal treatment in the regime of admission and treatment of investments made by foreign and domestic investors.

Uruguay is a party to the Patent Cooperation Treaty (PCT).