Skip to content
AI Policy Generator

ESWhat applies

Peru · Law

Personal Data Protection Law and its regulation

In forceLaw 29733 and SD 016-2024-JUS

Summary

Governs all personal data processing. The 2024 regulation adds rules on automated decisions and profiling, the Data Officer, transfers abroad and 48-hour breach notification, which cover most AI uses.

Who it applies to

Any person or organization that processes personal data in Peru.

Penalties

Fines for minor, serious and very serious violations set in UIT under Law 29733, plus coercive fines of up to 100 UIT for failing to follow corrective orders.

Official name
Ley N.° 29733, Ley de Protección de Datos Personales, y su Reglamento aprobado por Decreto Supremo N.° 016-2024-JUS
Official reference
Ley 29733, El Peruano, 3 de julio de 2011; DS 016-2024-JUS, separata especial de El Peruano, 30 de noviembre de 2024 (vigente a los 120 días calendario)
Regulator
National Personal Data Protection Authority (Ministry of Justice)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Disclose automated decisions and allow them to be reviewedLey 29733, art. 23; DS 016-2024-JUS, arts. 6.1.8 y 87In forceMarch 30, 2025Organizations that use AI to profile people or make decisions with legal or significant effects on them.Verified in the official source on November 4, 2026
Appoint a Personal Data OfficerDS 016-2024-JUS, arts. 37 a 39In forceMarch 30, 2025Public bodies, from the regulation's effective date, and companies that process data at large scale, process sensitive data or may significantly affect people, with a deadline that depends on annual sales.Verified in the official source on November 4, 2026
Report and register transfers of data abroadDS 016-2024-JUS, arts. 12 a 21In forceMarch 30, 2025Organizations that send personal data to vendors in other countries, for example when using AI services hosted abroad.Verified in the official source on November 4, 2026
Report serious data breaches within 48 hoursDS 016-2024-JUS, arts. 34 y 35In forceMarch 30, 2025Any organization that processes personal data in Peru, including breaches affecting AI systems. The 48-hour notice to the Authority relates to serious incidents.Verified in the official source on November 4, 2026
Register databases and document securityDS 016-2024-JUS, arts. IX.2, 42 a 47 y 51In forceMarch 30, 2025Any organization that processes personal data in Peru, including data that feeds AI systems.Verified in the official source on November 4, 2026
Data protection impact assessment recommendedDS 016-2024-JUS, art. 40Regulator guidanceAlready applicableRecommended when AI processes sensitive data, profiles people, affects vulnerable groups or processes data at large scale.Verified in the official source on November 4, 2026

Disclose automated decisions and allow them to be reviewed

Ley 29733, art. 23; DS 016-2024-JUS, arts. 6.1.8 y 87In force

Applies from March 30, 2025

When it relates
Organizations that use AI to profile people or make decisions with legal or significant effects on them.
What the rule provides
  • Tell people that automated decisions, including profiling, are used.
  • Respect the right not to be subject to decisions based solely on automated processing that produce legal or significant effects, except where the law allows it.
  • If data feeds a decision without the person's involvement, tell them as soon as possible.
Typical evidence
  • Privacy notice that mentions automated decisions and profiling
  • Human review procedure and request log
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): art. 6.1(8) (disclose automated decisions and profiling) and art. 87 (right to objective processing, with the exceptions in art. 23 of the Law). The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Appoint a Personal Data Officer

DS 016-2024-JUS, arts. 37 a 39In force

Applies from March 30, 2025

Deadlines by profile

  • : Public bodies: from the regulation's effective date
  • : Annual sales above 2,300 UIT: 1 year from publication
  • : Annual sales of 1,700 to 2,300 UIT: 2 years from publication
  • : Annual sales of 150 to 1,700 UIT: 3 years from publication
  • : Annual sales up to 150 UIT: 4 years from publication
When it relates
Public bodies, from the regulation's effective date, and companies that process data at large scale, process sensitive data or may significantly affect people, with a deadline that depends on annual sales.
What the rule provides
  • Appoint a Data Officer (internal, external or shared within the group) and publish their contact details.
  • Notify the National Data Protection Authority within 15 days.
Typical evidence
  • Appointment record and proof of notice to the authority
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): arts. 37-39 (37.4: publish contact details; 37.5: notify the Authority within 15 days) and first final supplementary provision: for the cases in art. 37.1(2) and (3) the deadline is 1 to 4 years "after the publication date" depending on sales (Nov 30, 2025 to Nov 30, 2028); public bodies are not phased. The questionnaire approximates sales by headcount. The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Report and register transfers of data abroad

DS 016-2024-JUS, arts. 12 a 21In force

Applies from March 30, 2025

When it relates
Organizations that send personal data to vendors in other countries, for example when using AI services hosted abroad.
What the rule provides
  • Have consent or a legal exception, or adequate safeguards such as model contract clauses.
  • Report each transfer to the National Data Protection Authority and register it.
Typical evidence
  • File per vendor: country, data, purpose, safeguard and proof of registration
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): arts. 12-21 (safeguards in art. 20; art. 21.2 requires notifying the Directorate General of the cross-border flow). The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Report serious data breaches within 48 hours

DS 016-2024-JUS, arts. 34 y 35In force

Applies from March 30, 2025

When it relates
Any organization that processes personal data in Peru, including breaches affecting AI systems. The 48-hour notice to the Authority relates to serious incidents.
What the rule provides
  • Notify the National Data Protection Authority within 48 hours of becoming aware of the incident when it exposes large volumes of data, may affect many people, involves sensitive data or causes evident harm to other rights (art. 34.1).
  • Notify affected people within 48 hours when the incident affects other rights of theirs (art. 34.3) and, if it happens in the digital environment, also report it to the National Digital Security Center (art. 34.5).
  • Document every incident, even if not reported (art. 35).
Typical evidence
  • Incident log and copies of notifications
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): art. 34.1 (48 hours only for serious incidents: large volumes, many people, sensitive data or evident harm), 34.3 and 34.5 (individuals and National Digital Security Center) and art. 35 (document every incident). The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Register databases and document security

DS 016-2024-JUS, arts. IX.2, 42 a 47 y 51In force

Applies from March 30, 2025

When it relates
Any organization that processes personal data in Peru, including data that feeds AI systems.
What the rule provides
  • Register personal databases with the National Personal Data Protection Registry.
  • Keep a security document, access logs for 2 years and regular backups, and be able to show compliance.
Typical evidence
  • Registration certificates and security document
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): art. 42 (registration duty), art. 47 (security document), access logs kept for two years and art. 51 (backups at least weekly). The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Data protection impact assessment recommended

DS 016-2024-JUS, art. 40Regulator guidance

Already applicable

When it relates
Recommended when AI processes sensitive data, profiles people, affects vulnerable groups or processes data at large scale.
What the rule provides
  • Assess processing risks before starting, with reference to NTP-ISO/IEC 27005 and NTP-ISO 31000.
Typical evidence
  • Impact assessment report
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): art. 40.1 ("optionally") and 40.2 (reference to NTP-ISO/IEC 27005 and NTP-ISO 31000); the Authority may set other cases. The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)