The processing by local establishment factor is used to determine the applicability of Uruguay's data protection law to entities that have a presence within the country's territory. ## Text of relevant provision Decree No. 414/009 Article 3(1A) states: "A) They are carried out by a database controller or processor established in Uruguayan territory, being the place where they exercise their activity, regardless of their legal form." Original language: "A) Se efectúen por un responsable o encargado de base de datos o tratamiento establecido en territorio uruguayo, siendo el lugar donde ejerce su actividad, cualquiera sea su forma jurídica." ## Analysis of provisions This provision establishes that Uruguay's data protection law applies when personal data processing activities are "carried out by a database controller or processor established in Uruguayan territory" ("Se efectúen por un responsable o encargado de base de datos o tratamiento establecido en territorio uruguayo"). The key factor here is the establishment of the entity within Uruguay's borders. The provision further clarifies that this establishment is determined by "the place where they exercise their activity" ("siendo el lugar donde ejerce su actividad"). This means that the actual location of operations is the determining factor, not just a formal registration or mailing address. Importantly, the provision specifies that this applies "regardless of their legal form" ("cualquiera sea su forma jurídica"). This broad language ensures that the law covers all types of entities, whether they are corporations, partnerships, sole proprietorships, or any other legal structure. The rationale behind this factor is to ensure that any entity with a significant presence in Uruguay is subject to its data protection laws, regardless of where the entity may be headquartered or incorporated. This approach helps prevent entities from avoiding compliance by simply incorporating elsewhere while still conducting substantial operations within Uruguay. ## Implications This provision has several important implications for businesses: 1. Any company with operations in Uruguay must comply with the country's data protection laws, even if it is a foreign entity. 2. The establishment factor is based on actual activity, not just formal registration. This means that even informal or temporary operations could potentially trigger applicability. 3. Companies cannot avoid compliance by choosing a particular legal structure, as the law applies regardless of the entity's form. 4. Multinational companies with branches or subsidiaries in Uruguay will need to ensure that their local operations comply with Uruguayan data protection law, even if their global policies are based on other jurisdictions' requirements. 5. Companies considering expanding into Uruguay should factor compliance with local data protection laws into their planning, as establishing any significant presence there will likely trigger the law's applicability.