Provides telecom services, in Peru

Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 12, 14 and 18 · Read the law's page

• This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on 4 November 2025, which is 3 February 2026.
• Manage the digital-security risks in your organization so as to set controls that protect the confidentiality, integrity and availability of information (article 14.1).
• Implement security controls and measures in providing your digital services according to your risk assessment, widely recognized practices, the national regulatory framework and international standards (article 18.1(b)).
• Maintain a secure, scalable and interoperable infrastructure that guarantees the confidentiality, availability and integrity of your digital services (article 18.1(f)).
• Test your digital services proactively for vulnerabilities so as to identify digital-security risks (article 18.1(i)).
• If a law or special rule also regulates your service, comply with your sector's rules first; the Regulation applies to what they do not provide (article 18.2).

Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 18.1(a) and 31 to 34 · Read the law's page

• This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on 4 November 2025, which is 3 February 2026.
• Notify the Centro Nacional de Seguridad Digital (CNSD) of the digital-security incidents of your organization through the protocols and channels it sets (article 18.1(a)).
• Notify an incident classified at critical level to the CNSD within a maximum of forty-eight (48) hours from when you become aware of it (article 32.1).
• Notify an incident of any other classification within the periods the Secretaría de Gobierno y Transformación Digital sets in its classification of digital-security incidents (article 32.2).
• Include in the notification at least a description of the incident, its classification and its impact (article 31.2).
• Make your third-party service providers report to you the incidents under their control, and notify the CNSD yourself (article 34.4).