---
title: "Peru Data Protection & Privacy Regulation | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/peru-data-protection-privacy-regulation/
source_html: /jurisdictions/peru/index.html
description: "Peru data protection and privacy regulation: 10 categories, 92 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…"
generated_at: 2026-11-07T14:58:19Z
content_sha256: 84ca4f272d26917b31d6edaef72629cf497ea3592b8e4f573bf3147582edf464
generator: "fe-fleet/md-twin@1.0"
---
# Peru Data Protection & Privacy Regulation | Data Protection Monitor

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

# Peru Data Protection & Privacy Regulation

schema gdpri-v2
trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/peru/), [World Payments](https://payments.gi/jurisdictions/peru/), artificial-intelligence

Last updated 2026-11-04 · 10 categories · 92
claims · 48 sources in the cumulative register

Download report (PDF) Expand all

Peru's data protection authority, the ANPD, published a wholly new implementing regulation for Ley 29733 this cycle: Decreto Supremo N° 016-2024-JUS, in force since 30 March 2025, repeals the prior 2013 regulation (D.S.

Data collected 2026-11-01 · Data published 2026-11-04

AI-assembled from cited sources

Not fully checked this cycle: Controller/Processor Duties, Enforcement & Redress (4 open gaps).

Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=PERU)[Build Report](/reports/?j=PERU)[Compare](/compare/?j=PERU)

Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority Autoridad Nacional de Protección de Datos Personales (ANPD) Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) 2026-11-30 Peru DPO (Oficial de Datos Personales) designation deadline — medium enterprises

Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain

10 Categories

0 Red categories 57 Sub-modules

92 Claims

20 Tier-1 sources

Traffic-light mix 4 green 6 amber
(sums to 10 rendered categories; click to filter)

No red categories; 19 sub-modules are flagged red.

## Jurisdiction lead brief

###### Latest update · 25 October 2026

#### Lead Signal

Peru's data-protection enforcement posture has escalated sharply: the Autoridad Nacional de Protección de Datos Personales (ANPD) conducted 760 inspections in 2025, a 67% increase over the 454 recorded in 2024, alongside 136 sanctioning procedures and more than S/11 million in fines for the year. A snapshot as of 14 May 2026 shows continuing high-volume activity, with 301 inspections, 52 sanctioning procedures and 141 trilateral procedures already recorded, and e-commerce has newly become one of the most-sanctioned sectors. The applicable fine schedule under Ley N.° 29733 is tiered: minor infringements up to 5 UIT, serious infringements up to 50 UIT, and very serious infringements up to 100 UIT, with a maximum fine equivalent to S/550,000 and a cap of 10% of annual gross revenue.

#### Other Developments

Controllers now face a 48-hour breach-notification duty under Article 34 of the Reglamento (D.S. N.° 016-2024-JUS), which has been in force since 31 March 2025: the ANPD must be notified within 48 hours of a controller becoming aware of a personal-data security incident, and affected individuals must be informed on the same timeline where they are directly affected. Separately, large companies with annual sales exceeding 2,300 UIT are required to designate an Oficial de Datos Personales (ODP) by 30 June 2026, and the ANPD has published a public list of designated officers since 13 April 2026, making compliance status externally verifiable for the first time.

#### Cross-Monitor Connections

The tightening of controller obligations and the rise in enforcement activity sit adjacent to developments tracked for Peru under the gambling and crypto monitors, where sanctions-schedule and anti-money-laundering obligations are separately in motion; readers following those monitors should treat the ANPD's parallel escalation as part of a broader pattern of more active Peruvian regulatory enforcement across sectors this year, without treating any of these regimes as interchangeable.

#### Outlook

The trajectory to watch is whether ANPD's 2025 enforcement volume is sustained or exceeded through the remainder of 2026, and whether the 30 June 2026 Oficial de Datos Personales deadline produces a further wave of sanctioning activity against companies that miss it. The newly public ODP list gives both the regulator and private parties a mechanism to identify non-compliant large companies, which may itself drive further enforcement referrals.

1 earlier update not shown here.

###### Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

Peru's data protection authority, the ANPD, published a wholly new implementing regulation for Ley 29733 this cycle: Decreto Supremo N° 016-2024-JUS, in force since 30 March 2025, repeals the prior 2013 regulation (D.S. 003-2013-JUS) and materially expands the law's scope. The new regulation broadens the definition of personal data to expressly include location data and online identifiers, and extends the law's territorial reach to foreign controllers that offer goods or services to, or profile, persons located in Peru — a GDPR-style extraterritorial-scope extension requiring such foreign controllers to appoint a local representative as the ANPD's contact point. The repeal-and-replace structure of this reform, rather than an incremental amendment to the 2013 text, indicates ANPD and the Ministry of Justice judged the prior regulation insufficiently comprehensive for the current data-processing landscape, particularly given the intervening decade's growth in location-based services and online-identifier-based tracking. This is a high-confidence, well-corroborated development (IAPP, CMS Law).

#### Other Developments

A new mandatory Oficial de Datos Personales role. The 2024 regulation makes designation of an Oficial de Datos Personales mandatory for public entities, for organisations conducting habitual, systematic or massive observation of personal data, and for organisations whose core business involves sensitive data. This extends a DPO-equivalent obligation into the private sector for the first time under this framework, a high-confidence finding sourced to KPMG Peru's coverage of the regulation.

ANPD enforcement activity surged in 2025. The regulator conducted 760 inspections in 2025, a sixty-seven percent increase over 454 inspections the prior year, opening 136 sanctioning procedures and imposing fines exceeding S/11 million (approximately USD 3.1 million). E-commerce entered the list of top-sanctioned sectors in 2025 and remained prominent into early 2026. These findings are sourced to a single tier-3 outlet (LexLatin) and should be read as probable rather than confirmed pending independent corroboration, though the scale and specificity of the reported figures support a reasonably high confidence reading. The sixty-seven percent year-on-year increase in inspections is among the more significant regulator-activity escalations observed this cycle, and it should be read alongside the new regulation's broadened scope: ANPD now has both an expanded legal basis for enforcement and a demonstrated increase in enforcement activity.

Cross-border adequacy criteria formalised. The 2024 regulation establishes minimum criteria for recognising whether a destination country offers an adequate level of data protection for cross-border transfers, though no specific new adequacy determination was confirmed this cycle. This is a structural, rather than case-specific, development: it establishes the test ANPD or the responsible ministry would apply to any future adequacy assessment, without itself constituting an adequacy finding for any country.

#### Cross-Monitor Connections

The sharp rise in ANPD enforcement activity, and the sectoral prominence of e-commerce among sanctioned entities, intersects with commercial-privacy questions that the World Payments Monitor's merchant-acquiring and product-innovation coverage may also touch from a payments-infrastructure angle, though this brief does not attempt that cross-domain analysis itself. The financial-sector overlay noted in this cycle's sectoral-watch material — SBS's two-factor-authentication and liability-shift rule for card transactions — intersects with this regulation's security-of-processing obligations, and readers with a payments-specific interest should refer to the World Payments Monitor's coverage for the underlying rule. No Financial Integrity Monitor or Crypto Monitor nexus is identified in this cycle's data-protection-specific evidence base.

#### Outlook

The clearest near-term item to watch is how the new Oficial de Datos Personales mandate beds in operationally: whether ANPD publishes guidance on the habitual/systematic/massive-processing threshold that triggers the designation requirement, and whether enforcement activity in 2026 continues at, or beyond, the pace set in 2025. A second item is whether the cross-border adequacy criteria formalised in the 2024 regulation produce an actual adequacy determination for any specific destination country; none has surfaced in the evidence base for this cycle. Organisations relying on cross-border transfers to or from Peru should also monitor whether ANPD issues guidance operationalising the newly-formalised adequacy criteria. Given the scale of the 2025 enforcement increase, e-commerce entities and other frequently-processing organisations operating in Peru should expect ANPD's compliance posture to remain assertive through the remainder of 2026. Taken as a whole, this cycle reflects an authority moving from a largely dormant enforcement posture to an actively engaged one.

Read full brief · 1093 words

Key regulatory facts for Peru Regulatory Dimension Peru Standing Position

Jurisdiction Peru (PE)

Regulatory Scope Data Protection & Privacy Regulation (10 modules, 92 sourced findings)

Regulator & Framework Mature omnibus statute with an operational, resourced supervisory authority and a freshly modernised implementing regulation in force since March 2025.

Lawful Processing & Special Data Lawful-basis and special-category rules are well documented and current; pseudonymisation/anonymisation safe-harbour detail is thin (absent_field_provenance applies to that sub-module).

Data Subject Rights Rights framework, deadlines and escalation path to ANPD are clearly documented and current post-2025 Reglamento.

Controller/Processor Duties Security, DPO and breach-notification duties are well documented and current; DPIA-trigger methodology and general retention/disposal rules are thin or absent in the sources reviewed.

Primary Instruments Cited Plataforma del Estado Peruano (gob.pe), MINJUSDH, MINJUSDH / El Peruano, SMV (mirror of MINJUSDH instrument), IAPP

Last Confirmed / Updated 2026-11-04 (48 sources in cumulative register)

10 of 10 categories

Signal
Red
Amber
Green

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### Peru: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Mature omnibus statute with an operational, resourced supervisory authority and a freshly modernised implementing regulation in force since March 2025.

Primary framework Ley N° 29733, Ley de Protección de Datos Personales (2011, as amended by Decreto Legislativo N° 1353 of 2017), and its Reglamento approved by Decreto Supremo N° 016-2024-JUS (in force since 31 March 2025)

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Green Mature omnibus statute with an operational, resourced supervisory authority and a freshly modernised implementing regulation in force since March 2025.

#### Sub-modules (5)

#### Regulator And AuthorityGreen

ANPD sits within MINJUSDH and exercises administrative, orienting, normative, resolutive, oversight and sanctioning functions via its Dirección de Protección de Datos Personales and Dirección de Fiscalización e Instrucción.

Claims (3):

- The Autoridad Nacional de Protección de Datos Personales (ANPD) operates two directorates, the Dirección de Protección de Datos Personales and the Dirección de Fiscalización e Instrucción, to enforce Ley N° 29733 and its Reglamento.
- ANPD — Created/reformed as the current supervisory body by Legislative Decree 1353 (2017), replacing an earlier, more limited body
- Autoridad Nacional de Protección de Datos Personales (ANPD) — the supervisory authority for data protection in Peru, within the Ministry of Justice and Human Rights, created/empowered by Decreto Legislativo N.° 1353 (2017)

#### Act And InstrumentsGreen

Core instrument is Ley 29733 as amended by DL 1353 (2017); operative secondary instrument is the new Reglamento (DS 016-2024-JUS), replacing DS 003-2013-JUS.

Claims (7):

- Decreto Legislativo N° 1353 (published 7 January 2017) created the current Autoridad Nacional de Transparencia y Acceso a la Información Pública framework and strengthened/reformed the personal-data-protection regime, establishing the ANPD as it exists today.
- The new Reglamento of Ley 29733, approved by Decreto Supremo N° 016-2024-JUS and published 30 November 2024, entered into force on 31 March 2025, repealing the prior 2013 regulation (DS 003-2013-JUS) and introducing new concepts, obligations and rights.
- Decreto Supremo N° 016-2024-JUS — Repeals the 2013 regulation
- ANPD — Decreto Supremo N 016-2024-JUS approved a new 135-article Reglamento of Ley 29733, which entered into force 31 March 2025, replacing the 2013 Reglamento and adding figures such as the Oficial de Datos Personales and mandatory breach notification.
- Reglamento D.S. N.° 016-2024-JUS — approved 30 November 2024, in force since 31 March 2025, implementing Ley N.° 29733
- Supreme Decree No. 016-2024-JUS — DS 016-2024-JUS (published 30 November 2024, effective 30 March 2025) replaces the 2013 Regulation (DS 003-2013-JUS) and expands territorial scope to foreign companies offering services to, or analysing the behaviour of, individuals in Peru, requiring a local representative
- Legislative Decree No. 1700 (24 January 2026) reportedly amends Law No. 30096 (Cybercrime Law); its precise interaction with the data-protection framework was not independently confirmed this cycle

#### Material ScopeGreen

The regime applies to all personal-data processing, automated or not, by natural persons, public entities or private-sector institutions, regardless of medium.

Claims (3):

- The Reglamento applies to every modality of personal-data processing carried out by natural persons, public entities, or private-sector institutions, irrespective of the medium in which the data are held.
- Ley N° 29733 — Applies to all organisations processing personal data regardless of size or commercial sector, correcting a common market assumption limiting it to large/transnational corporations
- Ley N.° 29733 — any natural or legal person, public or private, processing personal data in Peru, regardless of entity size

#### Territorial ScopeGreen

The 2024 Reglamento clarifies extraterritorial reach: it applies to processing carried out in Peru, by an encargado acting for a responsable in Peru regardless of the encargado's location, or by a responsable outside Peru that uses means located in Peru, offers goods/services to persons in Peru, or monitors their behaviour.

Claims (3):

- The Reglamento's Article IV extends application to processing performed in Peruvian territory, by an encargado wherever located acting on behalf of a responsable established in Peru, or by a responsable outside Peru that uses means in Peru, offers goods/services to persons in Peru, or analyses their behaviour.
- D.S. N.° 016-2024-JUS (Reglamento) — Regime extends to foreign companies offering goods/services to, or profiling, persons located in Peru, requiring a locally-domiciled representative
- Reglamento de la Ley de Protección de Datos Personales (D.S. N.° 016-2024-JUS) — Extends regime to foreign companies offering goods/services to, or profiling, persons in Peru; requires designation of a locally-domiciled representative

#### Regulator Registration And FilingAmber

Controllers (titulares) and processing entities must register the creation, modification or cancellation of 'bancos de datos personales' with the Registro Nacional de Protección de Datos Personales administered by ANPD.

Claims (2):

- Natural or legal persons in the private sector and public entities that create, modify or cancel bancos de datos personales are obligated to process the corresponding inscription before the Registro Nacional de Protección de Datos Personales.
- Controllers (data-bank holders) — personal-data banks (bancos de datos personales) with ANPD's Registro Nacional de Protección de Datos Personales (RNPDP); omission is treated as an infraction

Peru operates a comprehensive omnibus data-protection regime anchored on Ley N° 29733 (2011), Ley de Protección de Datos Personales, as substantially reformed by Decreto Legislativo N° 1353 (2017), which created the current Autoridad Nacional de Protección de Datos Personales (ANPD) within the Ministerio de Justicia y Derechos Humanos (MINJUSDH). A wholly new implementing regulation, Decreto Supremo N° 016-2024-JUS, was published 30 November 2024 and entered into force 31 March 2025, repealing the 2013 regulation (DS N° 003-2013-JUS) and modernising definitions (location/online identifiers, neural data), extraterritorial scope, portability, and breach-notification duties.

Periodic update · new data 2026-09-28

#### Regulator & Framework

Peru's data-protection framework continues to rest on Ley No. 29733 (as amended by Legislative Decree No. 1353), with its implementing regulation replaced by Supreme Decree No. 016-2024-JUS, effective 30 March 2025. That replacement of the 2013 regulation is understood to have expanded the law's territorial scope so that it now applies to foreign companies offering services to Peruvian customers or analysing the behaviour of individuals located in Peru, a change reported to require such companies to appoint a local representative in Peru. This extraterritorial expansion, if applied as described, materially widens the population of controllers who must attend to Peruvian compliance obligations regardless of physical presence in the country.

A separate development, Legislative Decree No. 1700 of 24 January 2026, reportedly amends Peru's Cybercrime Law, Law No. 30096. Its substantive content and any interaction with the data-protection framework under Ley No. 29733 and DS 016-2024-JUS were not independently confirmed this cycle; reports suggest the amendment exists, but its relevance to controllers and processors under the data-protection regime specifically remains unverified.

#### Outlook

Confirming the substantive content of Legislative Decree No. 1700 and its precise interaction, if any, with the data-protection framework is the primary open item for this module. Should DS 016-2024-JUS's expanded territorial-scope provisions see active enforcement against foreign controllers without a Peru presence, that would be a significant next development to track.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (18)
- [Plataforma del Estado Peruano (gob.pe)](https://www.gob.pe/anpd) — The Autoridad Nacional de Protección de Datos Personales (ANPD) operates two directorates, the Dirección de Protección de Datos Personales and the Dirección de Fiscalización e Instrucción, to enforce Ley N° 29733 and its Reglamento.
- [MINJUSDH](https://cdn.www.gob.pe/uploads/document/file/1801312/Sobre%20la%20distinci%C3%B3n%20entre%20el%20derecho%20de%20protecci%C3%B3n%20de%20datos%20personales%20y%20el%20derecho%20al%20secreto%20de%20las%20comunicaciones.pdf) — Decreto Legislativo N° 1353 (published 7 January 2017) created the current Autoridad Nacional de Transparencia y Acceso a la Información Pública framework and strengthened/reformed the personal-data-protection regime, establishing the ANPD as it exists today.
- [MINJUSDH / El Peruano](https://www.sat.gob.pe/TransparenciaV3/Portals/0/Docs/NormasOtrasEntidades/DecretoSupremo016-2024-JUS_ReglamentoLey29733_LeyProteccionDatosPersonales.pdf) — The new Reglamento of Ley 29733, approved by Decreto Supremo N° 016-2024-JUS and published 30 November 2024, entered into force on 31 March 2025, repealing the prior 2013 regulation (DS 003-2013-JUS) and introducing new concepts, obligations and rights.
- [SMV (mirror of MINJUSDH instrument)](https://www.smv.gob.pe/Uploads/Reglamento_LPDP.pdf) — The Reglamento applies to every modality of personal-data processing carried out by natural persons, public entities, or private-sector institutions, irrespective of the medium in which the data are held.
- [IAPP](https://iapp.org/news/a/se-publica-el-nuevo-reglamento-de-protecci-n-de-datos-personales-en-per-) — The Reglamento's Article IV extends application to processing performed in Peruvian territory, by an encargado wherever located acting on behalf of a responsable established in Peru, or by a responsable outside Peru that uses means in Peru, offers goods/services to persons in Peru, or analyses their behaviour.
- [SMV (mirror of MINJUSDH instrument)](https://www.smv.gob.pe/Uploads/Reglamento_LPDP.pdf) — Natural or legal persons in the private sector and public entities that create, modify or cancel bancos de datos personales are obligated to process the corresponding inscription before the Registro Nacional de Protección de Datos Personales.
- [IAPP](https://iapp.org/news/a/se-publica-el-nuevo-reglamento-de-protecci-n-de-datos-personales-en-per-) — Decreto Supremo N° 016-2024-JUS — Repeals the 2013 regulation
- [CMS Law](https://cms.law/es/per/publication/nuevo-reglamento-de-proteccion-de-datos-personales) — ANPD — Created/reformed as the current supervisory body by Legislative Decree 1353 (2017), replacing an earlier, more limited body
- [LP Derecho](https://lpderecho.pe/ley-proteccion-datos-personales-ley-29733-actualizada/) — ANPD — Decreto Supremo N 016-2024-JUS approved a new 135-article Reglamento of Ley 29733, which entered into force 31 March 2025, replacing the 2013 Reglamento and adding figures such as the Oficial de Datos Personales and mandatory breach notification.
- [LP Derecho](https://lpderecho.pe/ley-proteccion-datos-personales-ley-29733-actualizada/) — Ley N° 29733 — Applies to all organisations processing personal data regardless of size or commercial sector, correcting a common market assumption limiting it to large/transnational corporations
- [https://lunith.tech/guia-ley-29733](https://lunith.tech/guia-ley-29733) — Autoridad Nacional de Protección de Datos Personales (ANPD) — the supervisory authority for data protection in Peru, within the Ministry of Justice and Human Rights, created/empowered by Decreto Legislativo N.° 1353 (2017)
- [https://lunith.tech/guia-ley-29733](https://lunith.tech/guia-ley-29733) — Reglamento D.S. N.° 016-2024-JUS — approved 30 November 2024, in force since 31 March 2025, implementing Ley N.° 29733
- [Lunith](https://lunith.tech/guia-ley-29733) — Ley N.° 29733 — any natural or legal person, public or private, processing personal data in Peru, regardless of entity size
- [Lunith](https://lunith.tech/guia-ley-29733) — Controllers (data-bank holders) — personal-data banks (bancos de datos personales) with ANPD's Registro Nacional de Protección de Datos Personales (RNPDP); omission is treated as an infraction
- [CMS Law](https://cms.law/es/per/publication/nuevo-reglamento-de-proteccion-de-datos-personales) — D.S. N.° 016-2024-JUS (Reglamento) — Regime extends to foreign companies offering goods/services to, or profiling, persons located in Peru, requiring a locally-domiciled representative
- [dataprotection.gi](https://dataprotection.gi/jurisdictions/peru/) — Supreme Decree No. 016-2024-JUS — DS 016-2024-JUS (published 30 November 2024, effective 30 March 2025) replaces the 2013 Regulation (DS 003-2013-JUS) and expands territorial scope to foreign companies offering services to, or analysing the behaviour of, individuals in Peru, requiring a local representative
- [XMS Latam](https://www.xmslatam.com/pe/autoridad-nacional-proteccion-datos-personales/) — Legislative Decree No. 1700 (24 January 2026) reportedly amends Law No. 30096 (Cybercrime Law); its precise interaction with the data-protection framework was not independently confirmed this cycle
- [CMS Law](https://cms.law/es/per/publication/nuevo-reglamento-de-proteccion-de-datos-personales) — Reglamento de la Ley de Protección de Datos Personales (D.S. N.° 016-2024-JUS) — Extends regime to foreign companies offering goods/services to, or profiling, persons in Peru; requires designation of a locally-domiciled representative

### Peru: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Lawful-basis and special-category rules are well documented and current; pseudonymisation/anonymisation safe-harbour detail is thin (absent_field_provenance applies to that sub-module).

Primary framework Ley N° 29733 Arts. 13-14, 2(5); Reglamento (DS 016-2024-JUS) Título Preliminar Art. III

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Amber Lawful-basis and special-category rules are well documented and current; pseudonymisation/anonymisation safe-harbour detail is thin (absent_field_provenance applies to that sub-module).

D2 · Lawful Processing — Full Module Record 4 sub-modules · 62 words · 6 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Peru: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Rights framework, deadlines and escalation path to ANPD are clearly documented and current post-2025 Reglamento.

Primary framework Ley N° 29733 Título III (Arts. 18-24, as renumbered/expanded); Reglamento (DS 016-2024-JUS) Arts. 55, 76

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Green Rights framework, deadlines and escalation path to ANPD are clearly documented and current post-2025 Reglamento.

#### Sub-modules (5)

#### Access RightGreen

Data subjects may request confirmation and details of processing of their data; controllers must respond within 20 business days.

Claims (3):

- Controllers must respond to a data subject's exercise of the right of access within a maximum of 20 business days.
- Ley N° 29733 — Establishes the ARCO rights bundle (access, rectification, cancellation, opposition) for data subjects
- Data subjects (ARCO rights holders) — ARCO rights (access, rectification, cancellation/erasure, objection); companies must provide a visible channel to receive requests, failure to respond timely is an independent infraction

#### Rectification And ErasureGreen

Rectification and cancellation (erasure) requests must be answered within 10 business days; cancellation is unavailable where data are retained for historical, statistical, scientific, contractual or legal reasons.

Claims (2):

- Requests for rectification, cancellation or opposition must be answered by the controller within 10 business days.
- The cancellation right does not proceed where data are retained for historical, statistical or scientific reasons, where necessary for a contractual relationship, or where required to be processed by law.

#### Restriction And ObjectionGreen

Data subjects may oppose processing on justified, legitimate grounds relating to their particular situation where consent was not required; the controller must then cease the challenged processing if the opposition is well-founded.

Claims (1):

- A data subject may oppose processing of their data, absent prior consent, where founded and legitimate reasons relating to their concrete personal situation exist; if the opposition is justified, the controller or processor must act on it.

#### Data PortabilityGreen

The 2024 Reglamento introduces a portability right allowing data subjects to receive their data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, when processing is based on consent, contract, or automated means.

Claims (1):

- Article 76 of the 2024 Reglamento creates a portability right permitting data subjects to receive their personal data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, where processing is consent-based, contractual, or automated, provided this is not excessively onerous and is technically feasible.

#### Deadlines And Response WindowsGreen

Response deadlines (20 business days for access; 10 business days for rectification/cancellation/opposition) run from the day after submission and may be extended once for an equal period if circumstances justify it.

Claims (2):

- ARCO response deadlines may be extended once, for an equal period, when circumstances justify the extension, with the decision and justification communicated to the data subject within the original deadline.
- Reglamento article 132 — Attending to a data subject's ARCO-rights exercise outside the statutory deadline is newly defined as a minor infraction

Peru grants the classic ARCO rights (Acceso, Rectificación, Cancelación, Oposición) with statutory response deadlines of 20 business days for access and 10 business days for rectification, cancellation and opposition, extendable once for an equal period. The 2024 Reglamento adds a standalone portability right (Art. 76) as a manifestation of the access right. Unresolved ARCO disputes may be escalated to ANPD via a trilateral administrative procedure.

Sources and claims (9)
- [Plataforma del Estado Peruano (gob.pe)](https://www.gob.pe/9269-iniciar-procedimiento-para-el-ejercicio-de-derechos-de-acceso-rectificacion-cancelacion-y-oposicion) — Controllers must respond to a data subject's exercise of the right of access within a maximum of 20 business days.
- [Plataforma del Estado Peruano (gob.pe)](https://www.gob.pe/9269-iniciar-procedimiento-para-el-ejercicio-de-derechos-de-acceso-rectificacion-cancelacion-y-oposicion) — Requests for rectification, cancellation or opposition must be answered by the controller within 10 business days.
- [Plataforma del Estado Peruano (gob.pe)](https://www.gob.pe/9270-que-son-los-derechos-arco) — The cancellation right does not proceed where data are retained for historical, statistical or scientific reasons, where necessary for a contractual relationship, or where required to be processed by law.
- [Osinergmin (mirror)](https://www.osinergmin.gob.pe/seccion/centro_documental/Institucional/Transparencia/SAIP/Ley-29733.pdf) — A data subject may oppose processing of their data, absent prior consent, where founded and legitimate reasons relating to their concrete personal situation exist; if the opposition is justified, the controller or processor must act on it.
- [IAPP](https://iapp.org/news/a/se-publica-el-nuevo-reglamento-de-protecci-n-de-datos-personales-en-per-) — Article 76 of the 2024 Reglamento creates a portability right permitting data subjects to receive their personal data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, where processing is consent-based, contractual, or automated, provided this is not excessively onerous and is technically feasible.
- [SMV (mirror of MINJUSDH instrument)](https://www.smv.gob.pe/Uploads/Reglamento_LPDP.pdf) — ARCO response deadlines may be extended once, for an equal period, when circumstances justify the extension, with the decision and justification communicated to the data subject within the original deadline.
- [RecordingLaw](https://www.recordinglaw.com/es/world-laws/world-data-privacy-laws/peru-data-privacy-laws/) — Ley N° 29733 — Establishes the ARCO rights bundle (access, rectification, cancellation, opposition) for data subjects
- [dataprotection.gi](https://dataprotection.gi/jurisdictions/peru/) — Reglamento article 132 — Attending to a data subject's ARCO-rights exercise outside the statutory deadline is newly defined as a minor infraction
- [Kom.pe](https://kom.pe/proteccion-de-datos-personales-en-peru-guia-completa-para-emprendedores-2026/) — Data subjects (ARCO rights holders) — ARCO rights (access, rectification, cancellation/erasure, objection); companies must provide a visible channel to receive requests, failure to respond timely is an independent infraction

### Peru: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Security, DPO and breach-notification duties are well documented and current; DPIA-trigger methodology and general retention/disposal rules are thin or absent in the sources reviewed.

Primary framework Ley N° 29733 Art. 16; Reglamento (DS 016-2024-JUS) Arts. 34, 37, 47, 49-50

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Amber Security, DPO and breach-notification duties are well documented and current; DPIA-trigger methodology and general retention/disposal rules are thin or absent in the sources reviewed.

Periodic update · new data 2026-10-25

#### Controller/Processor Duties

Two controller-facing duties have moved into sharper focus in Peru. First, a 48-hour breach-notification requirement under Article 34 of the Reglamento (D.S. N.° 016-2024-JUS), in force since 31 March 2025, obliges controllers to notify the ANPD within 48 hours of becoming aware of a personal-data security incident, and to notify affected individuals on the same timeline where they are directly affected. This is a materially tight window by regional standards and leaves controllers little room to investigate internally before the notification clock runs out.

Second, large companies, those with annual sales exceeding 2,300 UIT, must designate an Oficial de Datos Personales (ODP), Peru's equivalent of a data protection officer, by 30 June 2026. Since 13 April 2026, the ANPD has published a public list of designated officers, which allows the regulator and third parties alike to verify whether a given company has complied. The combination of a hard deadline and a public compliance register increases the practical pressure on large controllers to complete the designation, since non-designation is now externally visible rather than only discoverable through an inspection.

#### Outlook

The 30 June 2026 deadline for ODP designation has passed as of this writing in relative terms to the compliance cycle, and the public list gives a mechanism for identifying companies that missed it; whether the ANPD moves from publication to active sanctioning against non-compliant large companies is the development to watch. Separately, no change to the 48-hour breach-notification duty itself is pending.

Periodic update · new data 2026-09-28

#### Controller/Processor Duties

Controller and processor obligations in Peru tightened materially this cycle with the entry into force, on 31 December 2025, of Directorial Resolution No. 100-2025-JUS-DGTAIPD. The resolution sets out detailed requirements for the designation, performance and functions of Data Protection Officers, including criteria for accredited data-protection knowledge that a controller must verify before appointing a DPO. This is a concrete strengthening of what had previously been a more general DPO obligation, and it raises the bar for controllers who had treated DPO designation as a formality rather than a substantively assessed role.

Alongside this, Supreme Decree No. 016-2024-JUS obligates controllers to notify data breaches to the National Authority for the Protection of Personal Data, ANPD, and ANPD has launched a unified breach-reporting form to standardise how those notifications are made. Together, the DPO Directive and the unified breach-reporting mechanism indicate a regulator building out the procedural infrastructure behind its statutory powers rather than resting on the bare text of the law.

#### Outlook

The practical operation of the DPO accredited-knowledge criterion, now in force, is the item most likely to generate compliance friction and further guidance in the near term. Continued uptake of the unified breach-reporting form, and any published statistics on its usage, would be the next indicator of how actively ANPD is operationalising these controller-duty developments.

D4 · Controller & Processor — Full Module Record 7 sub-modules · 95 words · 15 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Peru: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Transfer mechanism (adequacy-or-SCC) is clear and current; adequacy status (received/granted) and localisation posture rely on absence-of-evidence inference rather than a directly confirmed negative source.

Primary framework Ley N° 29733 Art. 15; Reglamento (DS 016-2024-JUS) Arts. 18-20

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Amber Transfer mechanism (adequacy-or-SCC) is clear and current; adequacy status (received/granted) and localisation posture rely on absence-of-evidence inference rather than a directly confirmed negative source.

D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 111 words · 4 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Peru: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Financial and health overlays are well evidenced with recent enforcement; employment, education and insurance sub-modules rely on absent_field_provenance.

Primary framework Ley N° 27489 (CEPIRS); Ley N° 26842 (Ley General de Salud); Ley N° 30024 (Historias Clínicas Electrónicas); Ley N° 29733 Reglamento Art. 26 (telemarketing)

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Amber Financial and health overlays are well evidenced with recent enforcement; employment, education and insurance sub-modules rely on absent_field_provenance.

D6 · Sectoral Watch — Full Module Record 7 sub-modules · 117 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Peru: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Direct-marketing consent rules are current and well evidenced; cookie/dark-pattern/opt-out-signal/clean-room sub-modules carry absent_field_provenance.

Primary framework Reglamento (DS 016-2024-JUS) Art. 26; Ley N° 29733 Art. 39 (infractions)

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Amber Direct-marketing consent rules are current and well evidenced; cookie/dark-pattern/opt-out-signal/clean-room sub-modules carry absent_field_provenance.

D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 69 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Peru: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Biometric-data enforcement is strongly evidenced and current; ADM-transparency, AI-risk-assessment and genetic-data sub-modules rely on absent_field_provenance.

Primary framework Ley N° 29733 Art. 2(5)(sensitive data definitions); Reglamento (DS 016-2024-JUS)

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Amber Biometric-data enforcement is strongly evidenced and current; ADM-transparency, AI-risk-assessment and genetic-data sub-modules rely on absent_field_provenance.

D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 103 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Peru: D9 Children & Vulnerable Groups5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Age-of-consent and parental-consent rules are clearly defined and current in the 2024 Reglamento; education-setting and dependent-adult sub-modules are thin/absent.

Primary framework Reglamento (DS 016-2024-JUS) Arts. 22, 23, 25, 27, 28

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Green Age-of-consent and parental-consent rules are clearly defined and current in the 2024 Reglamento; education-setting and dependent-adult sub-modules are thin/absent.

D9 · Children's Privacy — Full Module Record 5 sub-modules · 96 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Peru: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Sanctioning framework and recent enforcement activity are strongly evidenced and current; collective-redress/class-action mechanisms specific to data protection are thin/absent.

Primary framework Ley N° 29733 Arts. 38-40; Reglamento (DS 016-2024-JUS) Arts. 125, 132-134

Supervisory authority [Autoridad Nacional de Protección de Datos Personales (ANPD)](https://www.gob.pe/anpd)

Traffic-light rationale — Green Sanctioning framework and recent enforcement activity are strongly evidenced and current; collective-redress/class-action mechanisms specific to data protection are thin/absent.

Periodic update · new data 2026-10-25

#### Enforcement & Redress

The ANPD's enforcement activity grew sharply through 2025 and into 2026. The regulator conducted 760 inspections in 2025, up 67% from 454 in 2024, together with 136 sanctioning procedures and fines exceeding S/11 million for the year. A snapshot as of 14 May 2026 shows the pace continuing, with 301 inspections, 52 sanctioning procedures and 141 trilateral procedures already recorded, and e-commerce has newly emerged as one of the most-sanctioned sectors alongside whatever sectors previously dominated the ANPD's enforcement docket.

The statutory fine schedule under Ley N.° 29733 is tiered by severity: minor infringements carry fines up to 5 UIT, serious infringements up to 50 UIT, and very serious infringements up to 100 UIT, with an overall maximum fine equivalent to S/550,000 and an alternative cap of 10% of the sanctioned entity's annual gross revenue, whichever produces the more significant constraint on a large company. The combination of a rising inspection count and a revenue-linked penalty ceiling means exposure scales with company size rather than being capped at a fixed nominal amount for larger entities.

#### Outlook

The central question is whether the 2025 enforcement surge represents a new sustained baseline for ANPD activity or a one-off catch-up following the Reglamento's 2025 entry into force. The prominence of e-commerce among newly sanctioned sectors suggests the regulator is actively expanding its sectoral focus rather than simply processing a backlog, which points toward continued or increasing enforcement volume through the remainder of 2026.

Periodic update · new data 2026-09-28

#### Enforcement & Redress

ANPD's sanctioning regime rests on a three-tiered infraction and fine structure denominated in Unidades Impositivas Tributarias, with total fines capped at 10% of the offending entity's prior-year net revenue. The UIT value for 2026 is set at S/5,500 under Decreto Supremo No. 301-2025-EF, providing the monetary basis against which the tiered fine bands are calculated for infractions occurring this year.

Reporting attributes continued active enforcement to ANPD, including a fine against Magic Dynasty International Club S.A.C. of PEN 194,350 for improper data processing and lack of transparency, and a fine against Alfin Banco of PEN 669,000 for unlawful marketing and data acquisition without consent. The same reporting states that in 2023 alone ANPD issued more than S/2.7 million in fines and resolved 272 complaints. These figures are drawn from aggregator reporting rather than confirmed directly against ANPD's own resolution numbers or exact dates this cycle, and should be read with that caveat, though the overall pattern is consistent with an actively enforcing regulator rather than a dormant one.

#### Outlook

Independent confirmation of the exact dates and resolution numbers behind the Magic Dynasty and Alfin Banco fines, along with any more recent 2026 enforcement actions, would sharpen the picture of ANPD's current enforcement tempo. The outcome of ANPD's public consultation on its draft fine-calculation methodology, which closed for comment on 21 October 2025, was not located this cycle and remains an open item.

D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 113 words · 20 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

## GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map GDPR article to category mapping Article Category Sub-module

Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases

Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds

Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories

Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows

Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows

Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability

Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency

Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements

Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements

Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures

Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received

Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions

Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties