Uruguay

Yes, cloud data hosting involves treatment of information. In case said treatment is done by a third party, the Compilation of Control and Regulation Rules issued by UCB states that the outsourcing of data processing activities (under which concept cloud computing is included), whether it is total or partial, local or abroad, requires the authorization of UCB.
Regarding the conditions for said authorization, among other aspects, the abovementioned Regulation provides that the financial institutions must have both policies and established written procedures, as well as the necessary functional organization that ensures an effective identification, measurement, control and supervision of risks, both present and future, related to the outsourcing agreements for external data processing, whether the last in done locally or abroad.
With respect to the evaluation of risks regarding the personal data of the financial institutions´ clients, among other aspects it is provided that, when requesting the authorization, the financial institution must inform the measures taken and to be taken aimed at ensuring that the information will be kept confidential as requested by Uruguayan legislation.
One of the requisites for the outsourcing of data processing activities outside Uruguay is to keep physically in the country a copy of the safeguard of information and software proceedings, keeping said copy available to the Financial Supervisory Authority´s employees. In addition, those financial institutions which process information outside Uruguay must also have an operating mode and equipment that permanently enable the online access to both financial and accounting information from the terminals installed in Uruguay.
Additional measures are requested when the outsourcing data processing activities outside Uruguay is considered “significant” in the judgement of the Financial Supervisory Authority.