Cybersecurity regulation in Uruguay (2026)

Enacted February 20, 2025, this decree extends the mandatory AGESIC Cybersecurity Framework (MCU) to all public-sector entities and private entities linked to critical sectors (telecoms, energy, water, financial services, digital infrastructure). Obligations include designating a security officer, maintaining audit logs, and reporting cybersecurity incidents to CERTuy within 24 hours.

Enacted August 23, 2024, Law 20,327 on Prevention and Repression of Cybercrime introduced new Penal Code offences including unauthorised access, computer fraud, computer damage, data breach, identity usurpation, telematic harassment, and abuse of devices, carrying up to 24-month custodial sentences. It is explicitly framed as a step toward ratifying the Budapest Convention.

Approved by CAHSI in December 2024 and published by AGESIC, the strategy sets eight pillars covering governance, regulatory frameworks, critical-infrastructure protection, cybercrime capacity, international cooperation, and cybersecurity culture. Implementation is overseen by a National Cybersecurity Strategy Management Committee established under Law 20,212.

Decree 66/025 requires cybersecurity incidents at covered entities to be reported to CERTuy (AGESIC's national CSIRT) within 24 hours. Separately, data controllers must notify the data-protection authority URCDP within 72 hours of becoming aware of a personal-data security incident, with additional notification to affected individuals if the breach poses significant risk to their rights.

The Central Bank of Uruguay (BCU) issues cybersecurity and operational-resilience rules for the financial sector, while the telecoms regulator URSEC imposes sector-specific security requirements on communications operators. These sit alongside, and are coordinated with, the AGESIC/Decree 66/025 framework.

AGESIC (Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento) leads national cybersecurity policy, develops the MCU framework, operates CERTuy for incident coordination, and advises on the National Data Strategy. It works with the inter-institutional CAHSI advisory council.