Makes credit decisions, in Peru

Ley No. 29733, art. 23 (automated individual decisions) · Read the law's page

• Do not base a decision that has legal effects on a person, or significantly affects them, solely on an automated evaluation of their personality or conduct, outside a contractual relationship or a public-entity entry evaluation, and let them state their own view.

Reglamento Ley 29733 (DS 016-2024-JUS) data subject rights, arts. 68-69, 71, 73, 75-76, 82-83, 86-87 · Read the law's page

• Answer a request to exercise a data-protection right within 8 days for information, 20 days for access and 10 days for rectification, cancellation or opposition, counted from the day after the request is filed, whether or not you hold the person's data; extend a period other than the one for information once, by an equal period at most, where circumstances justify it and tell the person within the period.
• Keep the means to prove that you answered a rights request in time and in clear, legible, understandable form.
• Where you refuse a rights request in whole or in part, justify the refusal and tell the person they may bring a claim before the Dirección de Protección de Datos Personales or a habeas data action before the Judiciary.
• On an access request, tell the person which of their data you process, how and why you collected them, at whose request, and what transfers you made or plan.
• On a portability request, give the personal data the person supplied in a structured, commonly used, machine-readable format and, where technically possible, transmit them directly to another controller, where the processing rests on consent or a contract or is automated; the portability duty took effect 6 months after the Regulation entered into force.
• On an erasure request, stop processing the data by blocking them while deletion is assessed, document to the person that the request was met and identify to whom the deleted data had been transferred.
• Stop processing for advertising, commercial prospecting and profiling when the person objects, unless a prior contractual relationship supports it.
• Tell a person as soon as possible when their data are processed as part of a decision-making process without their participation.

Decreto Supremo 115-2025-PCM, arts. 22-23 (Reglamento de la Ley 31814, Clasificación de Riesgos: Uso Indebido) · Read the law's page

• Do not use an AI-based system to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter their behavior.
• Do not deploy an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting.
• Do not carry out mass surveillance using an AI-based system without a legal basis, or in a way that generates or may generate a disproportionate impact on fundamental rights.
• Do not analyze, classify, or infer a person's racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation from their biometric data using an AI-based system, and do not evaluate or classify people in a way that produces discriminatory or disproportionate results violating fundamental rights.
• Do not carry out real-time biometric identification to categorize people in public spaces, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes.
• Do not use an AI-based system to predict that a person will commit a crime based on profiling or an assessment of their personality traits.
• A system that supports a human evaluator's assessment of a person's involvement in an existing, verifiable criminal activity is not itself misuse under the real-time biometric identification prohibition, provided it carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination.

Decreto Supremo 115-2025-PCM, arts. 24-25 (Reglamento de la Ley 31814, Riesgo Alto y Transparencia Algorítmica) · Read the law's page

• Before a high-risk AI system interacts with a user, tell them, clearly and simply, its purpose or use, its main functions, and the kind of decisions it can make.
• Where a high-risk AI system's decision affects a person's human rights, explain the result to the affected user in accessible language, covering the criteria and factors the decision relied on.
• Ask the Secretaría de Gobierno y Transformación Digital for a determination if you are unsure whether your system's use falls within the high-risk category.
• A private-sector developer or implementer's transparency duty applies by sector, counted from the day after the Decreto Supremo's publication: one year for health, education, justice, security, and economy-finance; two years for transport, commerce, and labor; three years for production, agriculture, energy, and mining; and four years for every other use, with its own two-year and three-year schedule for small businesses and microenterprises.
• A breach of the personal-data and privacy rules that apply to a high-risk system is sanctioned under Ley 29733's own regime, not under this Decreto Supremo.

Proyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on 10 January 2025 · Read the law's page

• Cooperate with public entities to maintain national cybersecurity where you operate as a private legal person in Peru (article 8).