Processes personal data, in Peru

Ley No. 29733, Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017), arts. 1-10, 12-14, 16-17, 28-31 (object, definitions, scope, principles, lawful processing, security, confidentiality, and personal-data-bank obligations) · Read the law's page

• Obtain a person's prior, informed, express, and unequivocal consent before processing their personal data, unless a law authorizes the processing without it, and let them revoke that consent at any time under the same requirements that applied when they gave it.
• Do not collect personal data by fraudulent, unfair, or unlawful means, and collect only data that is updated, necessary, relevant, and adequate to a determined, explicit, and lawful purpose stated at the time of collection.
• Do not use personal data for a purpose other than the one that justified its collection, unless you first apply an anonymization or dissociation procedure.
• Adopt technical, organizational, and legal measures that guarantee the security of personal data and prevent its alteration, loss, unauthorized processing, or access, and do not process personal data in a data bank that does not meet the Authority's security requirements.
• Keep confidential any personal data you hold or process, and continue to do so even after your relationship with the data bank's owner ends.
• Register your personal-data bank with the Registro Nacional de Protección de Datos Personales before creating it, or, for a bank that predates the Law, declare it to the Authority within the deadline the regulation sets.
• As a processor handling personal data under contract for a third party, use it only for the purpose the contract states, do not transfer it to anyone else, and delete it once the contract is performed unless the data bank's owner authorized retaining it against a likely further engagement.

Ley No. 29733, arts. 11, 15 (cross-border transfer) · Read the law's page

• Before a cross-border transfer of personal data, confirm the destination country maintains an adequate level of protection under the Law, or, where it does not, guarantee as the sender that the processing will comply with the Law.
• Treat the adequate-protection requirement as met without a separate guarantee where the transfer falls under an international treaty Peru is party to, international judicial or anti-crime intelligence cooperation, performance of a contract the titleholder is party to, a banking or securities transaction, a medical or epidemiological purpose using dissociation, or the titleholder's prior, informed, express and unequivocal consent.
• Assess a cross-border transfer against a level of protection at least equivalent to this Law's own principles and to security and confidentiality measures appropriate to the data's category.

Ley No. 29733, arts. 18-22 and 24-27 (rights of the data subject) · Read the law's page

• Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.
• Tell a person when you engage a new processor after they gave consent, or when a merger, portfolio acquisition, or similar transfer gives their data a new data-bank owner.
• Give a person access, on request, to the personal data you hold on them, how you collected it, why, at whose request, and what transfers you made or plan to make.
• Correct, update, include, or delete a person's personal data on request when it is inaccurate, incomplete, or has outlived the purpose or period for which it was collected, tell anyone you previously transferred it to about the change, and block the data from third-party access while the request is pending.
• Stop supplying a person's personal data to others on their request to prevent supply, especially where the supply would affect a fundamental right.
• Stop processing a person's personal data on a well-founded, legitimate objection tied to their specific situation, absent their consent, and delete the data where the objection is justified.
• Let a person bring an unanswered or denied rights request to the Autoridad Nacional de Protección de Datos Personales or to the Judiciary through a habeas data action, and expect to compensate them for harm your breach of the Law causes.

Ley No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children) · Read the law's page

• For sensitive data (biometric data that by itself identifies a person, racial or ethnic origin, income, political, religious, philosophical or moral opinions, union affiliation, or health or sex-life information), obtain the titleholder's consent in writing, in addition to the general consent requirements, and do not process it without that written consent unless a law authorizes processing without it on important public-interest grounds.
• Process health data without consent only where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment at a health establishment or by a health-sciences professional observing professional secrecy, for a public-interest or public-health reason the Ministry of Health has qualified as such, or for an epidemiological or similar study using an adequate dissociation procedure.
• Let a child or adolescent exercise their data-protection rights through their legal representative, and apply any special measure the regulation sets for processing a minor's personal data.

Ley No. 29733, arts. 32-40 and Disposición complementaria final sexta (enforcement, supervisory authority and sanctions) · Read the law's page

• Expect the Autoridad Nacional de Protección de Datos Personales, within the Ministry of Justice and Human Rights, to open an investigation on its own initiative or on complaint, resolve titleholders' claims, and order precautionary or corrective measures or an administrative sanction for a breach of the Law or its regulation.
• Register your personal-data bank in the Registro Nacional de Protección de Datos Personales, and expect any cross-border data-flow communication, sanction, or precautionary or corrective measure to be recorded there too.
• Expect a fine of 0.5 to 5 Tax Units (UIT) for a minor infraction, more than 5 up to 50 UIT for a serious infraction, or more than 50 up to 100 UIT for a very serious infraction, capped at ten percent of your gross annual income for the preceding fiscal year, without prejudice to separate civil or criminal liability.
• Comply with an accessory obligation the sanctioning procedure imposes within its deadline, or expect a coercive fine of up to 10 UIT on top of the underlying sanction.
• Expect the constitutional habeas data process to remain open to a titleholder independently of, and without first requiring, the Law's own administrative procedure before the Authority.

Ley No. 31944 (El Peruano, 25 November 2023), amending art. 2(e) of Ley 27489, and first final complementary provision (credit reports and employment) · Read the law's page

• Do not put value judgments, rulings or subjective opinions about a person in a credit report, if you are a private credit-risk information bureau (CEPIR).
• Obtain a job candidate's written, unequivocal permission before you review their credit report when you recruit for a State institution or a public or private company, and do not exclude or disqualify the candidate on the strength of that report at any stage; the superintendencies of banking and securities and the entities they regulate or supervise are outside this rule.

Decreto Supremo No. 016-2024-JUS, Reglamento de la Ley No. 29733, Ley de Protección de Datos Personales, arts. 34-36 and 46 (security-incident notice and documentation; records of interactions with personal data) · Read the law's page

• Notify the Autoridad Nacional de Protección de Datos Personales within 48 hours of learning of a personal-data security incident that exposes large volumes of data, may affect a large number of people, involves sensitive data or clearly harms other rights of the data subject, and give the reasons and supporting evidence where the notice comes later than 48 hours.
• Tell the data subject within 48 hours, without undue delay and in plain language, of a security incident that affects other rights of the data subject, together with the measures adopted to mitigate its effects.
• Document every security incident, including the related facts, its effects and the measures adopted, so that the Authority can verify compliance.
• As a processor, inform the data bank holder or controller immediately of a security incident the processor learns of.
• Generate and keep records of interactions with personal data in each platform, website, mobile application, digital service or system used to process it, covering the user accounts with access, session start and end times and the actions of processing, viewing, modification, deletion, import and export, and keep them for at least two years.

Reglamento Ley 29733 (DS 016-2024-JUS) consent, data protection officer and registration, arts. 2-7, 9-10, 37, 42 and first final provision · Read the law's page

• Obtain consent to process personal data that is free, prior, express and unequivocal, and informed, asking for it before collecting the data or before a use different from the one the data were collected for; do not condition a service on data that is not indispensable to it.
• Do not treat publishing a privacy policy as a substitute for the data subject's consent.
• Prove consent whenever it is questioned: as holder of the data bank or controller, bear the burden of proof of consent in every case.
• Provide an easily accessible, unconditional, simple, quick and free way for a person to revoke consent.
• Designate a Personal Data Officer, publish the officer's contact details and tell the Autoridad Nacional de Protección de Datos Personales of them within 15 days, where a public entity processes the data, where the processing involves large volumes of data, sensitive data or evident harm to other rights, or where sensitive-data processing is a main business activity; in the cases of Article 37.1, points 2 and 3, the duty phases in by annual sales over four years from publication of the Regulation.
• Register the creation, modification or cancellation of a personal-data bank with the Registro Nacional de Protección de Datos Personales.

Reglamento Ley 29733 (DS 016-2024-JUS) cross-border flow, arts. 18-21 · Read the law's page

• Make a cross-border flow of personal data only to a receiver in a country with an adequate level of protection, which the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales determines by resolution; where the country has none, give adequate guarantees for the processing abroad, unless an exception in Article 15 of the Law applies.
• Where guarantees are needed, use model contractual clauses or other legal instruments that impose at least the same obligations the exporter is subject to, together with the conditions under which the data subject consented.
• Bring every cross-border flow of personal data to the attention of the Dirección General, with the information required for the transfer and for the data bank registration, using the approved format, so it is entered in the Registro Nacional de Protección de Datos Personales.

Reglamento Ley 29733 (DS 016-2024-JUS) data subject rights, arts. 68-69, 71, 73, 75-76, 82-83, 86-87 · Read the law's page

• Answer a request to exercise a data-protection right within 8 days for information, 20 days for access and 10 days for rectification, cancellation or opposition, counted from the day after the request is filed, whether or not you hold the person's data; extend a period other than the one for information once, by an equal period at most, where circumstances justify it and tell the person within the period.
• Keep the means to prove that you answered a rights request in time and in clear, legible, understandable form.
• Where you refuse a rights request in whole or in part, justify the refusal and tell the person they may bring a claim before the Dirección de Protección de Datos Personales or a habeas data action before the Judiciary.
• On an access request, tell the person which of their data you process, how and why you collected them, at whose request, and what transfers you made or plan.
• On a portability request, give the personal data the person supplied in a structured, commonly used, machine-readable format and, where technically possible, transmit them directly to another controller, where the processing rests on consent or a contract or is automated; the portability duty took effect 6 months after the Regulation entered into force.
• On an erasure request, stop processing the data by blocking them while deletion is assessed, document to the person that the request was met and identify to whom the deleted data had been transferred.
• Stop processing for advertising, commercial prospecting and profiling when the person objects, unless a prior contractual relationship supports it.
• Tell a person as soon as possible when their data are processed as part of a decision-making process without their participation.

Reglamento Ley 29733 (DS 016-2024-JUS) enforcement and sanctions, arts. 121-122, 124, 129-134 · Read the law's page

• Expect the Dirección de Protección de Datos Personales, once a sanctioning procedure has begun, to order provisional or precautionary measures and, alongside a sanction, corrective measures such as ceasing processing of data obtained disproportionately or without consent, deleting data obtained without consent, and immediately attending a right the data subject requested.
• Expect an automatic coercive fine, without prior demand, for failing to comply with a corrective or precautionary measure: up to 2 UIT for a minor, 2 to 6 UIT for a serious and 6 to 10 UIT for a very serious infraction, doubling successively up to 100 UIT while the failure persists.
• Where charged, prove in the reply the gross annual income received in the year before the infraction as the second paragraph of Article 39 of the Law provides.
• Expect a minor infraction for failing to communicate a cross-border flow for registration or to designate a Personal Data Officer where required; a serious infraction for processing without the required consent, for failing to notify a security incident under Article 34, and for refusing the Authority access or the documents it requests in an inspection; and a very serious infraction for processing by fraudulent, unfair or unlawful means.
• Expect those sanctioned, and the precautionary and corrective measures, to be recorded in the Registro Nacional de Protección de Datos Personales and published on the Ministry of Justice and Human Rights digital site.

Reglamento Ley 29733 (DS 016-2024-JUS) sensitive data and children, arts. 8, 22-23, 25 · Read the law's page

• Obtain consent to process sensitive data in writing, by handwritten, digital or electronic signature or another form that guarantees the data subject's will, in addition to meeting the requirements of valid consent.
• Process a child's or adolescent's data only with the consent of the person holding parental authority or guardianship, or, for a person over fourteen and under eighteen, with the person's own consent according to capacity where the information is given in language the person understands; for digital services, over fourteen and under eighteen consent for themselves and under fourteen needs the parent or guardian.
• Do not take a child's consent as a way to give the child access to activities tied to goods or services restricted for the child's age.
• Do not collect from a child or adolescent data that reveal information about other members of the family group, such as the parents' occupation or economic information, without those persons' consent; collect only the parents' or guardians' identity and address, where needed, to obtain consent.
• On digital platforms and services, make reasonable efforts, taking available technology into account, to verify the identity of those who give consent for a child or adolescent.

Constitución Política del Perú (1993), art. 2(6) (information services and personal and family privacy) · Read the law's page

• Do not supply information that affects a person's personal or family privacy through an information service, whether computerized or not, public or private.

Ley General de Salud, Ley No. 26842 (1997), art. 25 (confidentiality of information on the medical act) · Read the law's page

• Keep information about a medical act confidential if you are a health professional, technician or assistant, and do not give it out or disclose it by any means; disclosing it exposes you to civil or criminal liability, except with the patient's written consent, on a competent judicial authority's request, in anonymized form for academic or scientific research, or in another case the article lists.

Ley General de Salud, Ley No. 26842 (1997), art. 29 (copy of and access to the clinical record) · Read the law's page

• Give a patient, or the patient's legal representative, a copy of their clinical record, access to it and the clinical information it contains, whether handwritten or electronic, when they ask for it, if you are a health establishment or medical support service holding the record; the requester bears the cost.

Proyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on 10 January 2025 · Read the law's page

• Cooperate with public entities to maintain national cybersecurity where you operate as a private legal person in Peru (article 8).