Handles health records, in Peru

Ley No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children) · Read the law's page

• For sensitive data (biometric data that by itself identifies a person, racial or ethnic origin, income, political, religious, philosophical or moral opinions, union affiliation, or health or sex-life information), obtain the titleholder's consent in writing, in addition to the general consent requirements, and do not process it without that written consent unless a law authorizes processing without it on important public-interest grounds.
• Process health data without consent only where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment at a health establishment or by a health-sciences professional observing professional secrecy, for a public-interest or public-health reason the Ministry of Health has qualified as such, or for an epidemiological or similar study using an adequate dissociation procedure.
• Let a child or adolescent exercise their data-protection rights through their legal representative, and apply any special measure the regulation sets for processing a minor's personal data.

Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 12, 14 and 18 · Read the law's page

• This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on 4 November 2025, which is 3 February 2026.
• Manage the digital-security risks in your organization so as to set controls that protect the confidentiality, integrity and availability of information (article 14.1).
• Implement security controls and measures in providing your digital services according to your risk assessment, widely recognized practices, the national regulatory framework and international standards (article 18.1(b)).
• Maintain a secure, scalable and interoperable infrastructure that guarantees the confidentiality, availability and integrity of your digital services (article 18.1(f)).
• Test your digital services proactively for vulnerabilities so as to identify digital-security risks (article 18.1(i)).
• If a law or special rule also regulates your service, comply with your sector's rules first; the Regulation applies to what they do not provide (article 18.2).

Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 18.1(a) and 31 to 34 · Read the law's page

• This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on 4 November 2025, which is 3 February 2026.
• Notify the Centro Nacional de Seguridad Digital (CNSD) of the digital-security incidents of your organization through the protocols and channels it sets (article 18.1(a)).
• Notify an incident classified at critical level to the CNSD within a maximum of forty-eight (48) hours from when you become aware of it (article 32.1).
• Notify an incident of any other classification within the periods the Secretaría de Gobierno y Transformación Digital sets in its classification of digital-security incidents (article 32.2).
• Include in the notification at least a description of the incident, its classification and its impact (article 31.2).
• Make your third-party service providers report to you the incidents under their control, and notify the CNSD yourself (article 34.4).

Ley General de Salud, Ley No. 26842 (1997), art. 25 (confidentiality of information on the medical act) · Read the law's page

• Keep information about a medical act confidential if you are a health professional, technician or assistant, and do not give it out or disclose it by any means; disclosing it exposes you to civil or criminal liability, except with the patient's written consent, on a competent judicial authority's request, in anonymized form for academic or scientific research, or in another case the article lists.

Ley General de Salud, Ley No. 26842 (1997), art. 29 (copy of and access to the clinical record) · Read the law's page

• Give a patient, or the patient's legal representative, a copy of their clinical record, access to it and the clinical information it contains, whether handwritten or electronic, when they ask for it, if you are a health establishment or medical support service holding the record; the requester bears the cost.