Skip to content
AI Policy Generator

ESWhat applies

Other automated decisions with significant effects (housing, pricing, access to services) in Peru: related rules

Automated or AI-driven decisions that affect people outside employment and credit: housing rentals, personalized pricing, access to services, account blocking or legal services. They trigger rights regarding automated decisions under data protection laws and, in the US, consequential decision laws.

Risk classification

JurisdictionLevelDateNote
PeruData protectionMarch 31, 2025DS 016-2024-JUS Art. 87: right not to be subject to solely automated decisions with significant effects.

Obligations related to this use case

Disclose automated decisions and allow them to be reviewed

Law 29733 and SD 016-2024-JUSLey 29733, art. 23; DS 016-2024-JUS, arts. 6.1.8 y 87In force

Applies from March 30, 2025

When it relates
Organizations that use AI to profile people or make decisions with legal or significant effects on them.
What the rule provides
  • Tell people that automated decisions, including profiling, are used.
  • Respect the right not to be subject to decisions based solely on automated processing that produce legal or significant effects, except where the law allows it.
  • If data feeds a decision without the person's involvement, tell them as soon as possible.
Typical evidence
  • Privacy notice that mentions automated decisions and profiling
  • Human review procedure and request log
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): art. 6.1(8) (disclose automated decisions and profiling) and art. 87 (right to objective processing, with the exceptions in art. 23 of the Law). The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Appoint a Personal Data Officer

Law 29733 and SD 016-2024-JUSDS 016-2024-JUS, arts. 37 a 39In force

Applies from March 30, 2025

Deadlines by profile

  • : Public bodies: from the regulation's effective date
  • : Annual sales above 2,300 UIT: 1 year from publication
  • : Annual sales of 1,700 to 2,300 UIT: 2 years from publication
  • : Annual sales of 150 to 1,700 UIT: 3 years from publication
  • : Annual sales up to 150 UIT: 4 years from publication
When it relates
Public bodies, from the regulation's effective date, and companies that process data at large scale, process sensitive data or may significantly affect people, with a deadline that depends on annual sales.
What the rule provides
  • Appoint a Data Officer (internal, external or shared within the group) and publish their contact details.
  • Notify the National Data Protection Authority within 15 days.
Typical evidence
  • Appointment record and proof of notice to the authority
Verification
Verified in the official source on November 4, 2026Checked against Supreme Decree 016-2024-JUS (El Peruano special section of Nov 30, 2024, copy on gob.pe): arts. 37-39 (37.4: publish contact details; 37.5: notify the Authority within 15 days) and first final supplementary provision: for the cases in art. 37.1(2) and (3) the deadline is 1 to 4 years "after the publication date" depending on sales (Nov 30, 2025 to Nov 30, 2028); public bodies are not phased. The questionnaire approximates sales by headcount. The regulation applies "from 120 calendar days after" its Nov 30, 2024 publication; day 120 is Mar 30, 2025.

Related base documents

Find out what applies to you (free)Peru