Regulations › Rest of world › Peru
LPDP
Personal Data Protection Law No. 29733
WhenLaw published 3 Jul 2011 and fully effective after its first regulation (2013). The new Regulation (DS 016-2024-JUS, published 30 Nov 2024) took effect 30 Mar 2025, replacing DS 003-2013-JUS; DPO duties phase in through 30 Nov 2028.
Who enforces itAutoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights
Who it applies toPublic and private processing of personal data in Peru, and foreign controllers targeting or profiling people in Peru.
Tell the regulatorNotify the Authority within 48 hours of qualifying incidents (large-scale, sensitive data or m…
DPO requiredData protection officer required for public entities, large-scale or sensitive processing, and…
RegistrationCreation, modification and cancellation of personal data banks must be registered (free, autom…
Transfers abroadTransfers allowed to adequate countries or with safeguards such as model clauses
Request deadlineInformation within 8 business days, access 20 business days, rectification, cancellation or op…
Maximum fineUp to 100 UIT (about PEN 535,000, roughly USD 145,000), not exceeding 10% of prior-year gross…
71%
of Peru's 21 requirements are already met by European Union (GDPR). Here is what LPDP adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
LPDP adds3 Consent is the default basis; exceptions listed in the Law (public entities, public sources, contracts, health, anonymized data). No legitimate interests.
Law arts. 13, 14 · source ↗
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
LPDP adds2 Creation, modification and cancellation of personal data banks must be registered (free, automatic approval) with the National Registry.
Law art. 34; Reg. arts. 42-45 · source ↗
MarketingPeople's rightsGap
GDPR2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
LPDP adds3 Consent for marketing must be obtained directly; one first contact allowed to seek it, no further contact if refused; opt-outs handled within 10 days.
Reg. art. 26 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
LPDP adds2 Indefinite retention generally prohibited; processors keep data at most 2 years after the engagement ends; access logs kept at least 2 years.
Reg. arts. 31(2), 46(3) · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
LPDP adds3 Notify affected individuals within 48 hours, in plain language, when their rights are affected.
Reg. art. 34(3)-(4) · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
LPDP adds2 Penal Code offense for selling or trading non-public personal data without authorization: 2 to 5 years' imprisonment.
Penal Code art. 154-A · source ↗
Already covered by GDPR: Reach abroad, Consent, Sensitive data, Children, Rights, Request deadline, DPO required, DPO qualifications, DPIA, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.
A gap means LPDP is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws