PeruDecreto Legislativo 1700, illicit trafficking of computer data (art. 12-A of Ley 30096)
Decreto Legislativo 1700 () incorporating art. 12-A into Ley 30096, as amended by Decreto Legislativo 1741 ()
In force.
A computer misuse rule binding public and private bodies.
- Enforcement body
- Ministerio Público and the Poder Judicial, through ordinary criminal prosecution
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not possess, buy, receive, sell, exchange, facilitate, or traffic computer data, access credentials, or personal databases that you know or have reason to presume were obtained without the titleholder's consent or through a security breach or a computer offense.
- Handling such data with the titleholder's express authorization under Ley 29733, under a lawful judicial or administrative order, in the legitimate exercise of a recognized right or function, or as part of a securities, financial, pension, or insurance-sector activity is exempt, provided there is no purpose of unlawful gain or improper commercialization.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Five to eight years' imprisonment and 180 to 365 day-fines; eight to ten years' imprisonment with disqualification where the agent acts within a criminal organization, causes serious patrimonial harm or affects a plurality of persons, or the database is processed or held by a public entity (art. 12-A).
What it makes you log
Logging duty
Article 12-A punishes possessing, buying, receiving, selling, trading or trafficking computer data, access credentials or personal databases obtained without the holder's consent, through a security breach or through a computer crime, with a heavier penalty for a criminal organization, serious or mass harm, or a database held by a public body. Its exemption for acts done with the holder's express authorization under the personal data law, under a judicial or administrative mandate, or in the legitimate exercise of rights is a defence, not a record duty. The article carries no territorial clause.
- Kind
- None
- As of
What this law does
Article 12-A, incorporated into Ley 30096 by Decreto Legislativo 1700, punishes possessing, buying, receiving, marketing, selling, facilitating, exchanging, or trafficking computer data, access credentials, or personal databases, knowing or having reason to presume they were obtained without the titleholder's consent or through a security breach or the commission of a computer offense, with five to eight years' imprisonment and 180 to 365 day-fines.
The penalty rises to eight to ten years' imprisonment, with disqualification, where the agent acts as a member of a criminal organization, causes serious patrimonial harm or affects a plurality of persons, or the database is processed or held by a public entity.
Decreto Legislativo 1700 as published exempts from criminal liability conduct carried out with the titleholder's express authorization under Ley 29733, in compliance with a lawful judicial or administrative order, or in the legitimate exercise of fundamental rights or legally recognized functions, provided there is no purpose of unlawful gain or improper commercialization of the information.
Decreto Legislativo 1741 widened that clause to cover activities carried out in the securities, financial, pension, or insurance sectors. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .