Processes biometric data, in Peru

Ley No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children) · Read the law's page

• For sensitive data (biometric data that by itself identifies a person, racial or ethnic origin, income, political, religious, philosophical or moral opinions, union affiliation, or health or sex-life information), obtain the titleholder's consent in writing, in addition to the general consent requirements, and do not process it without that written consent unless a law authorizes processing without it on important public-interest grounds.
• Process health data without consent only where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment at a health establishment or by a health-sciences professional observing professional secrecy, for a public-interest or public-health reason the Ministry of Health has qualified as such, or for an epidemiological or similar study using an adequate dissociation procedure.
• Let a child or adolescent exercise their data-protection rights through their legal representative, and apply any special measure the regulation sets for processing a minor's personal data.

Decreto Supremo 115-2025-PCM, arts. 22-23 (Reglamento de la Ley 31814, Clasificación de Riesgos: Uso Indebido) · Read the law's page

• Do not use an AI-based system to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter their behavior.
• Do not deploy an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting.
• Do not carry out mass surveillance using an AI-based system without a legal basis, or in a way that generates or may generate a disproportionate impact on fundamental rights.
• Do not analyze, classify, or infer a person's racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation from their biometric data using an AI-based system, and do not evaluate or classify people in a way that produces discriminatory or disproportionate results violating fundamental rights.
• Do not carry out real-time biometric identification to categorize people in public spaces, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes.
• Do not use an AI-based system to predict that a person will commit a crime based on profiling or an assessment of their personality traits.
• A system that supports a human evaluator's assessment of a person's involvement in an existing, verifiable criminal activity is not itself misuse under the real-time biometric identification prohibition, provided it carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination.

Proyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on 10 January 2025 · Read the law's page

• Cooperate with public entities to maintain national cybersecurity where you operate as a private legal person in Peru (article 8).