Regulations › Rest of world › Peru
LPDP
Personal Data Protection Law No. 29733
WhenLaw published 3 Jul 2011 and fully effective after its first regulation (2013). The new Regulation (DS 016-2024-JUS, published 30 Nov 2024) took effect 30 Mar 2025, replacing DS 003-2013-JUS; DPO duties phase in through 30 Nov 2028.
Who enforces itAutoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights
Who it applies toPublic and private processing of personal data in Peru, and foreign controllers targeting or profiling people in Peru.
Tell the regulatorNotify the Authority within 48 hours of qualifying incidents (large-scale, sensitive data or m…
DPO requiredData protection officer required for public entities, large-scale or sensitive processing, and…
RegistrationCreation, modification and cancellation of personal data banks must be registered (free, autom…
Transfers abroadTransfers allowed to adequate countries or with safeguards such as model clauses
Request deadlineInformation within 8 business days, access 20 business days, rectification, cancellation or op…
Maximum fineUp to 100 UIT (about PEN 535,000, roughly USD 145,000), not exceeding 10% of prior-year gross…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Covers non-established controllers that offer goods or services to, or profile, people in Peru; they must appoint a representative.Reg. Arts. VI, VII · source ↗
Lawful basis
3
Consent is the default basis; exceptions listed in the Law (public entities, public sources, contracts, health, anonymized data). No legitimate interests.Law arts. 13, 14 · secondary source · source ↗
Law text read from a reproduction of the official statute.
Consent
2
Consent must be free, prior, express, unequivocal and informed; it may be verbal, written or by click. Controller bears burden of proof.Reg. arts. 2, 5, 9 · source ↗
Sensitive data
2
Sensitive data, including biometric, genetic and neural data, requires written consent by signature or equivalent.Law art. 13; Reg. arts. III, 8 · source ↗
Children
2
Minors 14 to 18 may consent if information is understandable; under 14 needs parental or guardian consent; reasonable age verification required.Reg. arts. 22, 25 · source ↗
People's rights
Rights
3
Information, access, portability, rectification, cancellation, opposition, and objective treatment (no solely automated decisions with significant effects).Law arts. 18-23; Reg. arts. 74-76 · source ↗
Portability enforceable from 30 Sep 2025 (Cuatrecasas).
Request deadline
2
Information within 8 business days, access 20 business days, rectification, cancellation or opposition 10 business days; one equal extension.Reg. arts. 69, 71 · source ↗
Scored on the 20-day access deadline; other requests fall under 21 days.
Marketing
3
Consent for marketing must be obtained directly; one first contact allowed to seek it, no further contact if refused; opt-outs handled within 10 days.Reg. art. 26 · source ↗
Governance
DPO required
1
Data protection officer required for public entities, large-scale or sensitive processing, and core sensitive-data activities; phased in by company size through Nov 2028.Reg. art. 37 · source ↗
Phase-in by annual sales: over 2,300 UIT by 30 Nov 2025; down to micro firms by 30 Nov 2028 (Cuatrecasas).
DPO qualifications
1
Regulation sets a DPO profile and functions; contact details must be communicated to the Authority within 15 days.Reg. arts. 37(4)-(5), 38, 39 · source ↗
Content of the art. 38 profile not confirmed.
Registration
2
Creation, modification and cancellation of personal data banks must be registered (free, automatic approval) with the National Registry.Law art. 34; Reg. arts. 42-45 · source ↗
DPIA
1
Impact assessment is optional, suggested for sensitive data, profiling, vulnerable groups or large volumes.Reg. art. 40(1) · source ↗
Records
2
A dated security document must include an inventory of personal data and processing systems, kept for Authority review.Reg. (article not confirmed) · secondary source · source ↗
Retention
2
Indefinite retention generally prohibited; processors keep data at most 2 years after the engagement ends; access logs kept at least 2 years.Reg. arts. 31(2), 46(3) · source ↗
Breaches
Tell the regulator
2
Notify the Authority within 48 hours of qualifying incidents (large-scale, sensitive data or many affected); digital incidents also to the National Digital Security Center.Reg. art. 34(1), (5) · source ↗
Tell people
3
Notify affected individuals within 48 hours, in plain language, when their rights are affected.Reg. art. 34(3)-(4) · source ↗
Transfers
Transfers abroad
2
Transfers allowed to adequate countries or with safeguards such as model clauses; every cross-border flow must be notified to the Authority.Law art. 15; Reg. arts. 18-21 · source ↗
Enforcement
Maximum fine
2
Up to 100 UIT (about PEN 535,000, roughly USD 145,000), not exceeding 10% of prior-year gross income.Law art. 39 · secondary source · source ↗
Peso estimate uses the 2025 UIT of PEN 5,350.
Criminal liability
2
Penal Code offense for selling or trading non-public personal data without authorization: 2 to 5 years' imprisonment.Penal Code art. 154-A · secondary source · source ↗
Private action
2
Anyone harmed may claim compensation; denied rights can be pursued before the Authority or by habeas data action.Law arts. 24, 25 · secondary source · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws