For a long time, cybersecurity incidents were primarily seen as a technical issue. In the face of an attack, a vulnerability or an information leak, the answer seemed quite clear: call the IT area, contain the incident, recover the systems and return to operation.
However, the Uruguayan regulatory framework is beginning to show more clearly that cybersecurity must also be analyzed from another perspective: legal responsibility and compliance.
A recent example is Decree No. 168/026 of July 17, 2026, which amends Decree No. 66/025 and establishes new obligations for the management of cybersecurity in the State.
One of the most interesting novelties is the incorporation of Article 20 bis. Upon detection of an information security incident, the entities concerned must immediately initiate the corresponding administrative procedures.
But perhaps the most relevant appears when analyzing why the incident occurred. If this was caused by a lack of foresight, inadequate processes, the use of obsolete or outdated systems, or non-compliance with the measures provided for in the Cybersecurity Framework, the entity must adopt the necessary adjustments or adaptations and inform AGESIC.
This introduces a question that seems fundamental to me: is it enough to say “we were victims of a cyberattack”?
Increasingly, the answer seems to be no. It will also be necessary to determine whether the organization has previously taken reasonable and appropriate measures to prevent, detect and respond to such an incident.
Change does not arise in isolation. Decree No. 66/025 had already established obligations related to the reporting of potential incidents, collaboration with CERTuy, the preservation of audit trails and compliance with the Cybersecurity Framework.
In turn, Uruguay’s Cybersecurity Framework 5.0 is aligned with the NIST Cybersecurity Framework 2.0 and structures its requirements into six major functions: govern, identify, protect, detect, respond and recover.
The first of these functions is particularly significant: to govern. Cybersecurity should no longer be understood exclusively as a responsibility of the technology department. It also involves internal policies, assignment of responsibilities, risk assessment, supplier contracting, training, response procedures, and management decisions. In short, it is progressively becoming a matter of governance and compliance.
There is also another aspect of particular interest to the private sector. Decree No. 66/025 establishes that obliged entities must ensure that outsourced services comply with the Cybersecurity Framework. Therefore, the impact of these requirements does not necessarily end at the door of the public body.
Software companies, cloud service providers, infrastructure, storage, technology support, and other providers that contract with covered entities may face increasing contractual and technical demands on security.
This also requires greater attention to be paid to the negotiation of technology contracts. What security standards must the supplier meet? Who should report an incident and within what timeframe? Who responds if a vendor vulnerability compromises customer systems or information? Should there be audit rights? Who bears the costs arising from an incident?
These are questions that should progressively become part of any relevant technology contract.
Added to this is another legal dimension that should not be lost sight of: the protection of personal data. Many cybersecurity incidents also involve a personal data breach.
Think, for example, of a ransomware attack that allows access to a database with information on thousands of people. The same event can generate consequences in terms of cybersecurity and data protection, but also administrative, contractual and, eventually, civil liabilities.
This forces us to abandon the idea that a security incident belongs exclusively to the IT area. When there are personal data, contracts with third parties, confidential information or essential services involved, prevention and response must necessarily be multidisciplinary.
Decree No. 168/026 is aimed at the state level covered by the regulation and, of course, it is not appropriate to automatically transfer its obligations to the private sector as a whole. However, it does reflect a regulatory trend that is worth watching.
The focus begins to shift from a purely reactive question — “what did the organization do after the attack?” — to another, possibly more relevant from a legal point of view: “What had the organisation done before the attack to prevent it?”.
That difference can end up being decisive when analyzing responsibilities.
Cybersecurity is no longer just a matter of firewalls, passwords, and servers. It is also a matter of risk management, data protection, contracts, governance and regulatory compliance.