REP27 · EU representative · Uruguay
Article 27 GDPR · Uruguay
If your company is established in Uruguay and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Law 18.331 governs processing in Uruguay, and the country holds an EU adequacy decision. Adequacy covers transfers, not representation: Article 27 still applies to companies established outside the Union.
€10 million or 2%Failing to designate is a standalone infringement under Article 83(4)(a) GDPR — whichever amount is higher. EDPB Guidelines 3/2018 confirm it is a breach in its own right, not a detail.
Software and IT services for European clients, beef and agricultural exporters, and fintech operating from free zones.
Regulators read the site the way a customer would. Prices in euro, a shipping option to Ireland, a checkout in French: each one is evidence you envisaged the Union.
Store listings available in EU countries, telemetry from European devices and accounts held by people in the Union all bring you inside Article 3(2).
As a processor you are caught in your own right. Your client's designation covers your client, never you.
Law 18.331 governs processing in Uruguay and the URCDP supervises it. Uruguay holds an adequacy decision with the Union — one of the few in Latin America, and again about transfers.
the Unidad Reguladora y de Control de Datos Personales. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Uruguayan companies reach the Union through software and IT services for European clients, beef and agricultural exports, and fintech operating from free zones.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The exact Article 13(1)(a) and 14(1)(a) sentence, generated in each language your site uses, ready to paste. Most files stall here, so we remove the step.
Your certificate carries a code. Scanning it opens a page that reads the register live: active, under review, suspended, revoked or expired. Nothing to take on trust.
From the Standard plan we keep the records and produce them to a supervisory authority on request, telling you the same day it happened.
No. Free-zone rules are Uruguayan. The GDPR applies because of where your customers are, and it wants a representative inside the Union regardless of your domestic tax regime.
For transfers, nearly. For Article 3 and Article 27, no. Adequacy does not make Uruguay a member state, and third-country companies designate a representative.
As a processor under Article 3(2), yes. And your client will usually ask for the designation before renewing the contract.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Uruguay's adequacy decision creates the most common misunderstanding we see in the region: it covers the data, not the duty.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check