Data Protection Monitor
Global Privacy & Data Protection Intelligence

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Peru Data Protection & Privacy Regulation

PE schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated · 10 categories · 92 claims · 48 sources in the cumulative register

Peru's data protection authority, the ANPD, published a wholly new implementing regulation for Ley 29733 this cycle: Decreto Supremo N° 016-2024-JUS, in force since 30 March 2025, repeals the prior 2013 regulation (D.S.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: Controller/Processor Duties, Enforcement & Redress (4 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureRegulated (omnibus)10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)Primary statutory & supervisory perimeter
Next milestone (> 2026-10-26)2026-11-30Peru DPO (Oficial de Datos Personales) designation deadline — medium enterprises
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 10 Probable · 0 Uncertain

Jurisdiction lead brief

Latest update · 25 October 2026

Lead Signal

Peru's data-protection enforcement posture has escalated sharply: the Autoridad Nacional de Protección de Datos Personales (ANPD) conducted 760 inspections in 2025, a 67% increase over the 454 recorded in 2024, alongside 136 sanctioning procedures and more than S/11 million in fines for the year. A snapshot as of 14 May 2026 shows continuing high-volume activity, with 301 inspections, 52 sanctioning procedures and 141 trilateral procedures already recorded, and e-commerce has newly become one of the most-sanctioned sectors. The applicable fine schedule under Ley N.° 29733 is tiered: minor infringements up to 5 UIT, serious infringements up to 50 UIT, and very serious infringements up to 100 UIT, with a maximum fine equivalent to S/550,000 and a cap of 10% of annual gross revenue.

Key regulatory facts for Peru
Regulatory DimensionPeru Standing Position
JurisdictionPeru (PE)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 92 sourced findings)
Regulator & FrameworkMature omnibus statute with an operational, resourced supervisory authority and a freshly modernised implementing regulation in force since March 2025.
Lawful Processing & Special DataLawful-basis and special-category rules are well documented and current; pseudonymisation/anonymisation safe-harbour detail is thin (absent_field_provenance applies to that sub-module).
Data Subject RightsRights framework, deadlines and escalation path to ANPD are clearly documented and current post-2025 Reglamento.
Controller/Processor DutiesSecurity, DPO and breach-notification duties are well documented and current; DPIA-trigger methodology and general retention/disposal rules are thin or absent in the sources reviewed.
Primary Instruments CitedPlataforma del Estado Peruano (gob.pe), MINJUSDH, MINJUSDH / El Peruano, SMV (mirror of MINJUSDH instrument), IAPP
Last Confirmed / Updated2026-11-04 (48 sources in cumulative register)

#

Mature omnibus statute with an operational, resourced supervisory authority and a freshly modernised implementing regulation in force since March 2025.

Primary frameworkLey N° 29733, Ley de Protección de Datos Personales (2011, as amended by Decreto Legislativo N° 1353 of 2017), and its Reglamento approved by Decreto Supremo N° 016-2024-JUS (in force since 31 March 2025)
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — GreenMature omnibus statute with an operational, resourced supervisory authority and a freshly modernised implementing regulation in force since March 2025.

Sub-modules (5)

Regulator And AuthorityGreen

ANPD sits within MINJUSDH and exercises administrative, orienting, normative, resolutive, oversight and sanctioning functions via its Dirección de Protección de Datos Personales and Dirección de Fiscalización e Instrucción.

Claims (3):

  • The Autoridad Nacional de Protección de Datos Personales (ANPD) operates two directorates, the Dirección de Protección de Datos Personales and the Dirección de Fiscalización e Instrucción, to enforce Ley N° 29733 and its Reglamento.
  • ANPD — Created/reformed as the current supervisory body by Legislative Decree 1353 (2017), replacing an earlier, more limited body
  • Autoridad Nacional de Protección de Datos Personales (ANPD) — the supervisory authority for data protection in Peru, within the Ministry of Justice and Human Rights, created/empowered by Decreto Legislativo N.° 1353 (2017)

Act And InstrumentsGreen

Core instrument is Ley 29733 as amended by DL 1353 (2017); operative secondary instrument is the new Reglamento (DS 016-2024-JUS), replacing DS 003-2013-JUS.

Claims (7):

  • Decreto Legislativo N° 1353 (published 7 January 2017) created the current Autoridad Nacional de Transparencia y Acceso a la Información Pública framework and strengthened/reformed the personal-data-protection regime, establishing the ANPD as it exists today.
  • The new Reglamento of Ley 29733, approved by Decreto Supremo N° 016-2024-JUS and published 30 November 2024, entered into force on 31 March 2025, repealing the prior 2013 regulation (DS 003-2013-JUS) and introducing new concepts, obligations and rights.
  • Decreto Supremo N° 016-2024-JUS — Repeals the 2013 regulation
  • ANPD — Decreto Supremo N 016-2024-JUS approved a new 135-article Reglamento of Ley 29733, which entered into force 31 March 2025, replacing the 2013 Reglamento and adding figures such as the Oficial de Datos Personales and mandatory breach notification.
  • Reglamento D.S. N.° 016-2024-JUS — approved 30 November 2024, in force since 31 March 2025, implementing Ley N.° 29733
  • Supreme Decree No. 016-2024-JUS — DS 016-2024-JUS (published 30 November 2024, effective 30 March 2025) replaces the 2013 Regulation (DS 003-2013-JUS) and expands territorial scope to foreign companies offering services to, or analysing the behaviour of, individuals in Peru, requiring a local representative
  • Legislative Decree No. 1700 (24 January 2026) reportedly amends Law No. 30096 (Cybercrime Law); its precise interaction with the data-protection framework was not independently confirmed this cycle

Material ScopeGreen

The regime applies to all personal-data processing, automated or not, by natural persons, public entities or private-sector institutions, regardless of medium.

Claims (3):

  • The Reglamento applies to every modality of personal-data processing carried out by natural persons, public entities, or private-sector institutions, irrespective of the medium in which the data are held.
  • Ley N° 29733 — Applies to all organisations processing personal data regardless of size or commercial sector, correcting a common market assumption limiting it to large/transnational corporations
  • Ley N.° 29733 — any natural or legal person, public or private, processing personal data in Peru, regardless of entity size

Territorial ScopeGreen

The 2024 Reglamento clarifies extraterritorial reach: it applies to processing carried out in Peru, by an encargado acting for a responsable in Peru regardless of the encargado's location, or by a responsable outside Peru that uses means located in Peru, offers goods/services to persons in Peru, or monitors their behaviour.

Claims (3):

  • The Reglamento's Article IV extends application to processing performed in Peruvian territory, by an encargado wherever located acting on behalf of a responsable established in Peru, or by a responsable outside Peru that uses means in Peru, offers goods/services to persons in Peru, or analyses their behaviour.
  • D.S. N.° 016-2024-JUS (Reglamento) — Regime extends to foreign companies offering goods/services to, or profiling, persons located in Peru, requiring a locally-domiciled representative
  • Reglamento de la Ley de Protección de Datos Personales (D.S. N.° 016-2024-JUS) — Extends regime to foreign companies offering goods/services to, or profiling, persons in Peru; requires designation of a locally-domiciled representative

Regulator Registration And FilingAmber

Controllers (titulares) and processing entities must register the creation, modification or cancellation of 'bancos de datos personales' with the Registro Nacional de Protección de Datos Personales administered by ANPD.

Claims (2):

  • Natural or legal persons in the private sector and public entities that create, modify or cancel bancos de datos personales are obligated to process the corresponding inscription before the Registro Nacional de Protección de Datos Personales.
  • Controllers (data-bank holders) — personal-data banks (bancos de datos personales) with ANPD's Registro Nacional de Protección de Datos Personales (RNPDP); omission is treated as an infraction
Category narrative 90 words

Peru operates a comprehensive omnibus data-protection regime anchored on Ley N° 29733 (2011), Ley de Protección de Datos Personales, as substantially reformed by Decreto Legislativo N° 1353 (2017), which created the current Autoridad Nacional de Protección de Datos Personales (ANPD) within the Ministerio de Justicia y Derechos Humanos (MINJUSDH). A wholly new implementing regulation, Decreto Supremo N° 016-2024-JUS, was published 30 November 2024 and entered into force 31 March 2025, repealing the 2013 regulation (DS N° 003-2013-JUS) and modernising definitions (location/online identifiers, neural data), extraterritorial scope, portability, and breach-notification duties.

Periodic update · new data 2026-09-28

Regulator & Framework

Peru's data-protection framework continues to rest on Ley No. 29733 (as amended by Legislative Decree No. 1353), with its implementing regulation replaced by Supreme Decree No. 016-2024-JUS, effective 30 March 2025. That replacement of the 2013 regulation is understood to have expanded the law's territorial scope so that it now applies to foreign companies offering services to Peruvian customers or analysing the behaviour of individuals located in Peru, a change reported to require such companies to appoint a local representative in Peru. This extraterritorial expansion, if applied as described, materially widens the population of controllers who must attend to Peruvian compliance obligations regardless of physical presence in the country.

A separate development, Legislative Decree No. 1700 of 24 January 2026, reportedly amends Peru's Cybercrime Law, Law No. 30096. Its substantive content and any interaction with the data-protection framework under Ley No. 29733 and DS 016-2024-JUS were not independently confirmed this cycle; reports suggest the amendment exists, but its relevance to controllers and processors under the data-protection regime specifically remains unverified.

Outlook

Confirming the substantive content of Legislative Decree No. 1700 and its precise interaction, if any, with the data-protection framework is the primary open item for this module. Should DS 016-2024-JUS's expanded territorial-scope provisions see active enforcement against foreign controllers without a Peru presence, that would be a significant next development to track.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (18)
  1. Probable Plataforma del Estado Peruano (gob.pe) — The Autoridad Nacional de Protección de Datos Personales (ANPD) operates two directorates, the Dirección de Protección de Datos Personales and the Dirección de Fiscalización e Instrucción, to enforce Ley N° 29733 and its Reglamento. observed
  2. Probable MINJUSDH — Decreto Legislativo N° 1353 (published 7 January 2017) created the current Autoridad Nacional de Transparencia y Acceso a la Información Pública framework and strengthened/reformed the personal-data-protection regime, establishing the ANPD as it exists today. observed
  3. Probable MINJUSDH / El Peruano — The new Reglamento of Ley 29733, approved by Decreto Supremo N° 016-2024-JUS and published 30 November 2024, entered into force on 31 March 2025, repealing the prior 2013 regulation (DS 003-2013-JUS) and introducing new concepts, obligations and rights. observed
  4. Probable SMV (mirror of MINJUSDH instrument) — The Reglamento applies to every modality of personal-data processing carried out by natural persons, public entities, or private-sector institutions, irrespective of the medium in which the data are held. observed
  5. Probable IAPP — The Reglamento's Article IV extends application to processing performed in Peruvian territory, by an encargado wherever located acting on behalf of a responsable established in Peru, or by a responsable outside Peru that uses means in Peru, offers goods/services to persons in Peru, or analyses their behaviour. observed
  6. Probable SMV (mirror of MINJUSDH instrument) — Natural or legal persons in the private sector and public entities that create, modify or cancel bancos de datos personales are obligated to process the corresponding inscription before the Registro Nacional de Protección de Datos Personales. observed
  7. High IAPP — Decreto Supremo N° 016-2024-JUS — Repeals the 2013 regulation observed
  8. Probable CMS Law — ANPD — Created/reformed as the current supervisory body by Legislative Decree 1353 (2017), replacing an earlier, more limited body observed
  9. Probable LP Derecho — ANPD — Decreto Supremo N 016-2024-JUS approved a new 135-article Reglamento of Ley 29733, which entered into force 31 March 2025, replacing the 2013 Reglamento and adding figures such as the Oficial de Datos Personales and mandatory breach notification. observed
  10. Probable LP Derecho — Ley N° 29733 — Applies to all organisations processing personal data regardless of size or commercial sector, correcting a common market assumption limiting it to large/transnational corporations observed
  11. Probable https://lunith.tech/guia-ley-29733 — Autoridad Nacional de Protección de Datos Personales (ANPD) — the supervisory authority for data protection in Peru, within the Ministry of Justice and Human Rights, created/empowered by Decreto Legislativo N.° 1353 (2017)
  12. Probable https://lunith.tech/guia-ley-29733 — Reglamento D.S. N.° 016-2024-JUS — approved 30 November 2024, in force since 31 March 2025, implementing Ley N.° 29733
  13. Probable Lunith — Ley N.° 29733 — any natural or legal person, public or private, processing personal data in Peru, regardless of entity size observed
  14. Probable Lunith — Controllers (data-bank holders) — personal-data banks (bancos de datos personales) with ANPD's Registro Nacional de Protección de Datos Personales (RNPDP); omission is treated as an infraction observed
  15. Probable CMS Law — D.S. N.° 016-2024-JUS (Reglamento) — Regime extends to foreign companies offering goods/services to, or profiling, persons located in Peru, requiring a locally-domiciled representative observed
  16. Probable dataprotection.gi — Supreme Decree No. 016-2024-JUS — DS 016-2024-JUS (published 30 November 2024, effective 30 March 2025) replaces the 2013 Regulation (DS 003-2013-JUS) and expands territorial scope to foreign companies offering services to, or analysing the behaviour of, individuals in Peru, requiring a local representative
  17. Uncertain XMS Latam — Legislative Decree No. 1700 (24 January 2026) reportedly amends Law No. 30096 (Cybercrime Law); its precise interaction with the data-protection framework was not independently confirmed this cycle observed
  18. Probable CMS Law — Reglamento de la Ley de Protección de Datos Personales (D.S. N.° 016-2024-JUS) — Extends regime to foreign companies offering goods/services to, or profiling, persons in Peru; requires designation of a locally-domiciled representative observed

#

Lawful-basis and special-category rules are well documented and current; pseudonymisation/anonymisation safe-harbour detail is thin (absent_field_provenance applies to that sub-module).

Primary frameworkLey N° 29733 Arts. 13-14, 2(5); Reglamento (DS 016-2024-JUS) Título Preliminar Art. III
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — AmberLawful-basis and special-category rules are well documented and current; pseudonymisation/anonymisation safe-harbour detail is thin (absent_field_provenance applies to that sub-module).
D2 · Lawful Processing — Full Module Record4 sub-modules · 62 words · 6 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Rights framework, deadlines and escalation path to ANPD are clearly documented and current post-2025 Reglamento.

Primary frameworkLey N° 29733 Título III (Arts. 18-24, as renumbered/expanded); Reglamento (DS 016-2024-JUS) Arts. 55, 76
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — GreenRights framework, deadlines and escalation path to ANPD are clearly documented and current post-2025 Reglamento.

Sub-modules (5)

Access RightGreen

Data subjects may request confirmation and details of processing of their data; controllers must respond within 20 business days.

Claims (3):

  • Controllers must respond to a data subject's exercise of the right of access within a maximum of 20 business days.
  • Ley N° 29733 — Establishes the ARCO rights bundle (access, rectification, cancellation, opposition) for data subjects
  • Data subjects (ARCO rights holders) — ARCO rights (access, rectification, cancellation/erasure, objection); companies must provide a visible channel to receive requests, failure to respond timely is an independent infraction

Rectification And ErasureGreen

Rectification and cancellation (erasure) requests must be answered within 10 business days; cancellation is unavailable where data are retained for historical, statistical, scientific, contractual or legal reasons.

Claims (2):

  • Requests for rectification, cancellation or opposition must be answered by the controller within 10 business days.
  • The cancellation right does not proceed where data are retained for historical, statistical or scientific reasons, where necessary for a contractual relationship, or where required to be processed by law.

Restriction And ObjectionGreen

Data subjects may oppose processing on justified, legitimate grounds relating to their particular situation where consent was not required; the controller must then cease the challenged processing if the opposition is well-founded.

Claims (1):

  • A data subject may oppose processing of their data, absent prior consent, where founded and legitimate reasons relating to their concrete personal situation exist; if the opposition is justified, the controller or processor must act on it.

Data PortabilityGreen

The 2024 Reglamento introduces a portability right allowing data subjects to receive their data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, when processing is based on consent, contract, or automated means.

Claims (1):

  • Article 76 of the 2024 Reglamento creates a portability right permitting data subjects to receive their personal data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, where processing is consent-based, contractual, or automated, provided this is not excessively onerous and is technically feasible.

Deadlines And Response WindowsGreen

Response deadlines (20 business days for access; 10 business days for rectification/cancellation/opposition) run from the day after submission and may be extended once for an equal period if circumstances justify it.

Claims (2):

  • ARCO response deadlines may be extended once, for an equal period, when circumstances justify the extension, with the decision and justification communicated to the data subject within the original deadline.
  • Reglamento article 132 — Attending to a data subject's ARCO-rights exercise outside the statutory deadline is newly defined as a minor infraction
Category narrative 65 words

Peru grants the classic ARCO rights (Acceso, Rectificación, Cancelación, Oposición) with statutory response deadlines of 20 business days for access and 10 business days for rectification, cancellation and opposition, extendable once for an equal period. The 2024 Reglamento adds a standalone portability right (Art. 76) as a manifestation of the access right. Unresolved ARCO disputes may be escalated to ANPD via a trilateral administrative procedure.

Sources and claims (9)
  1. Probable Plataforma del Estado Peruano (gob.pe) — Controllers must respond to a data subject's exercise of the right of access within a maximum of 20 business days. observed
  2. Probable Plataforma del Estado Peruano (gob.pe) — Requests for rectification, cancellation or opposition must be answered by the controller within 10 business days. observed
  3. Probable Plataforma del Estado Peruano (gob.pe) — The cancellation right does not proceed where data are retained for historical, statistical or scientific reasons, where necessary for a contractual relationship, or where required to be processed by law. observed
  4. Probable Osinergmin (mirror) — A data subject may oppose processing of their data, absent prior consent, where founded and legitimate reasons relating to their concrete personal situation exist; if the opposition is justified, the controller or processor must act on it. observed
  5. Probable IAPP — Article 76 of the 2024 Reglamento creates a portability right permitting data subjects to receive their personal data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, where processing is consent-based, contractual, or automated, provided this is not excessively onerous and is technically feasible. observed
  6. Probable SMV (mirror of MINJUSDH instrument) — ARCO response deadlines may be extended once, for an equal period, when circumstances justify the extension, with the decision and justification communicated to the data subject within the original deadline. observed
  7. Probable RecordingLaw — Ley N° 29733 — Establishes the ARCO rights bundle (access, rectification, cancellation, opposition) for data subjects
  8. Probable dataprotection.gi — Reglamento article 132 — Attending to a data subject's ARCO-rights exercise outside the statutory deadline is newly defined as a minor infraction
  9. Probable Kom.pe — Data subjects (ARCO rights holders) — ARCO rights (access, rectification, cancellation/erasure, objection); companies must provide a visible channel to receive requests, failure to respond timely is an independent infraction observed

#

Security, DPO and breach-notification duties are well documented and current; DPIA-trigger methodology and general retention/disposal rules are thin or absent in the sources reviewed.

Primary frameworkLey N° 29733 Art. 16; Reglamento (DS 016-2024-JUS) Arts. 34, 37, 47, 49-50
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — AmberSecurity, DPO and breach-notification duties are well documented and current; DPIA-trigger methodology and general retention/disposal rules are thin or absent in the sources reviewed.
Periodic update · new data 2026-10-25

Controller/Processor Duties

Two controller-facing duties have moved into sharper focus in Peru. First, a 48-hour breach-notification requirement under Article 34 of the Reglamento (D.S. N.° 016-2024-JUS), in force since 31 March 2025, obliges controllers to notify the ANPD within 48 hours of becoming aware of a personal-data security incident, and to notify affected individuals on the same timeline where they are directly affected. This is a materially tight window by regional standards and leaves controllers little room to investigate internally before the notification clock runs out.

Second, large companies, those with annual sales exceeding 2,300 UIT, must designate an Oficial de Datos Personales (ODP), Peru's equivalent of a data protection officer, by 30 June 2026. Since 13 April 2026, the ANPD has published a public list of designated officers, which allows the regulator and third parties alike to verify whether a given company has complied. The combination of a hard deadline and a public compliance register increases the practical pressure on large controllers to complete the designation, since non-designation is now externally visible rather than only discoverable through an inspection.

Outlook

The 30 June 2026 deadline for ODP designation has passed as of this writing in relative terms to the compliance cycle, and the public list gives a mechanism for identifying companies that missed it; whether the ANPD moves from publication to active sanctioning against non-compliant large companies is the development to watch. Separately, no change to the 48-hour breach-notification duty itself is pending.

Periodic update · new data 2026-09-28

Controller/Processor Duties

Controller and processor obligations in Peru tightened materially this cycle with the entry into force, on 31 December 2025, of Directorial Resolution No. 100-2025-JUS-DGTAIPD. The resolution sets out detailed requirements for the designation, performance and functions of Data Protection Officers, including criteria for accredited data-protection knowledge that a controller must verify before appointing a DPO. This is a concrete strengthening of what had previously been a more general DPO obligation, and it raises the bar for controllers who had treated DPO designation as a formality rather than a substantively assessed role.

Alongside this, Supreme Decree No. 016-2024-JUS obligates controllers to notify data breaches to the National Authority for the Protection of Personal Data, ANPD, and ANPD has launched a unified breach-reporting form to standardise how those notifications are made. Together, the DPO Directive and the unified breach-reporting mechanism indicate a regulator building out the procedural infrastructure behind its statutory powers rather than resting on the bare text of the law.

Outlook

The practical operation of the DPO accredited-knowledge criterion, now in force, is the item most likely to generate compliance friction and further guidance in the near term. Continued uptake of the unified breach-reporting form, and any published statistics on its usage, would be the next indicator of how actively ANPD is operationalising these controller-duty developments.

D4 · Controller & Processor — Full Module Record7 sub-modules · 95 words · 15 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Transfer mechanism (adequacy-or-SCC) is clear and current; adequacy status (received/granted) and localisation posture rely on absence-of-evidence inference rather than a directly confirmed negative source.

Primary frameworkLey N° 29733 Art. 15; Reglamento (DS 016-2024-JUS) Arts. 18-20
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — AmberTransfer mechanism (adequacy-or-SCC) is clear and current; adequacy status (received/granted) and localisation posture rely on absence-of-evidence inference rather than a directly confirmed negative source.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 111 words · 4 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Financial and health overlays are well evidenced with recent enforcement; employment, education and insurance sub-modules rely on absent_field_provenance.

Primary frameworkLey N° 27489 (CEPIRS); Ley N° 26842 (Ley General de Salud); Ley N° 30024 (Historias Clínicas Electrónicas); Ley N° 29733 Reglamento Art. 26 (telemarketing)
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — AmberFinancial and health overlays are well evidenced with recent enforcement; employment, education and insurance sub-modules rely on absent_field_provenance.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 117 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Direct-marketing consent rules are current and well evidenced; cookie/dark-pattern/opt-out-signal/clean-room sub-modules carry absent_field_provenance.

Primary frameworkReglamento (DS 016-2024-JUS) Art. 26; Ley N° 29733 Art. 39 (infractions)
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — AmberDirect-marketing consent rules are current and well evidenced; cookie/dark-pattern/opt-out-signal/clean-room sub-modules carry absent_field_provenance.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 69 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Biometric-data enforcement is strongly evidenced and current; ADM-transparency, AI-risk-assessment and genetic-data sub-modules rely on absent_field_provenance.

Primary frameworkLey N° 29733 Art. 2(5)(sensitive data definitions); Reglamento (DS 016-2024-JUS)
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — AmberBiometric-data enforcement is strongly evidenced and current; ADM-transparency, AI-risk-assessment and genetic-data sub-modules rely on absent_field_provenance.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 103 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Age-of-consent and parental-consent rules are clearly defined and current in the 2024 Reglamento; education-setting and dependent-adult sub-modules are thin/absent.

Primary frameworkReglamento (DS 016-2024-JUS) Arts. 22, 23, 25, 27, 28
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — GreenAge-of-consent and parental-consent rules are clearly defined and current in the 2024 Reglamento; education-setting and dependent-adult sub-modules are thin/absent.
D9 · Children's Privacy — Full Module Record5 sub-modules · 96 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Sanctioning framework and recent enforcement activity are strongly evidenced and current; collective-redress/class-action mechanisms specific to data protection are thin/absent.

Primary frameworkLey N° 29733 Arts. 38-40; Reglamento (DS 016-2024-JUS) Arts. 125, 132-134
Supervisory authorityAutoridad Nacional de Protección de Datos Personales (ANPD)
Traffic-light rationale — GreenSanctioning framework and recent enforcement activity are strongly evidenced and current; collective-redress/class-action mechanisms specific to data protection are thin/absent.
Periodic update · new data 2026-10-25

Enforcement & Redress

The ANPD's enforcement activity grew sharply through 2025 and into 2026. The regulator conducted 760 inspections in 2025, up 67% from 454 in 2024, together with 136 sanctioning procedures and fines exceeding S/11 million for the year. A snapshot as of 14 May 2026 shows the pace continuing, with 301 inspections, 52 sanctioning procedures and 141 trilateral procedures already recorded, and e-commerce has newly emerged as one of the most-sanctioned sectors alongside whatever sectors previously dominated the ANPD's enforcement docket.

The statutory fine schedule under Ley N.° 29733 is tiered by severity: minor infringements carry fines up to 5 UIT, serious infringements up to 50 UIT, and very serious infringements up to 100 UIT, with an overall maximum fine equivalent to S/550,000 and an alternative cap of 10% of the sanctioned entity's annual gross revenue, whichever produces the more significant constraint on a large company. The combination of a rising inspection count and a revenue-linked penalty ceiling means exposure scales with company size rather than being capped at a fixed nominal amount for larger entities.

Outlook

The central question is whether the 2025 enforcement surge represents a new sustained baseline for ANPD activity or a one-off catch-up following the Reglamento's 2025 entry into force. The prominence of e-commerce among newly sanctioned sectors suggests the regulator is actively expanding its sectoral focus rather than simply processing a backlog, which points toward continued or increasing enforcement volume through the remainder of 2026.

Periodic update · new data 2026-09-28

Enforcement & Redress

ANPD's sanctioning regime rests on a three-tiered infraction and fine structure denominated in Unidades Impositivas Tributarias, with total fines capped at 10% of the offending entity's prior-year net revenue. The UIT value for 2026 is set at S/5,500 under Decreto Supremo No. 301-2025-EF, providing the monetary basis against which the tiered fine bands are calculated for infractions occurring this year.

Reporting attributes continued active enforcement to ANPD, including a fine against Magic Dynasty International Club S.A.C. of PEN 194,350 for improper data processing and lack of transparency, and a fine against Alfin Banco of PEN 669,000 for unlawful marketing and data acquisition without consent. The same reporting states that in 2023 alone ANPD issued more than S/2.7 million in fines and resolved 272 complaints. These figures are drawn from aggregator reporting rather than confirmed directly against ANPD's own resolution numbers or exact dates this cycle, and should be read with that caveat, though the overall pattern is consistent with an actively enforcing regulator rather than a dormant one.

Outlook

Independent confirmation of the exact dates and resolution numbers behind the Magic Dynasty and Alfin Banco fines, along with any more recent 2026 enforcement actions, would sharpen the picture of ANPD's current enforcement tempo. The outcome of ANPD's public consultation on its draft fine-calculation methodology, which closed for comment on 21 October 2025, was not located this cycle and remains an open item.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 113 words · 20 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 92 claim(s) (92 category placement(s)), 48 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: not settled (2 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 82Enforcement & Redressprivate right of action
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties