71%
of Uruguay's 21 requirements are already met by European Union (GDPR). Here is what LPDP adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
LPDP adds3 Consent is the default basis, with exceptions for public sources, state functions, limited listings, contracts and domestic use. No legitimate interests.
Art. 9 · source ↗
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
LPDP adds2 All public and private databases, other than purely personal ones, must be registered with the URCDP, including foreign controllers in scope.
Arts. 28-29; Decree 64/020 art. 2 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
LPDP adds3 Consent must be free, prior, express and informed, and must be documented.
Arts. 4(C), 9 · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
LPDP adds3 Access and rectification or suppression requests within 5 business days.
Arts. 14, 15 · source ↗
DPO qualificationsGovernanceGap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
LPDP adds2 DPO must prove specialized legal knowledge in data protection; designation must be communicated to the URCDP within 90 days.
Decree 64/020 arts. 12, 14 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
LPDP adds2 Delete data once no longer necessary; negative credit records limited to 5 years, renewable once.
Arts. 8, 22 · source ↗
Already covered by GDPR: Reach abroad, Sensitive data, Children, Rights, Marketing, DPO required, DPIA, Records, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.
A gap means LPDP is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
