PeruRegulation of the Digital Trust Framework (Supreme Decree 126-2025-PCM), Notification of Digital-Security Incidents
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on , which is .
- Notify the Centro Nacional de Seguridad Digital (CNSD) of the digital-security incidents of your organization through the protocols and channels it sets (article 18.1(a)).
- Notify an incident classified at critical level to the CNSD within a maximum of forty-eight (48) hours from when you become aware of it (article 32.1).
- Notify an incident of any other classification within the periods the Secretaría de Gobierno y Transformación Digital sets in its classification of digital-security incidents (article 32.2).
- Include in the notification at least a description of the incident, its classification and its impact (article 31.2).
- Make your third-party service providers report to you the incidents under their control, and notify the CNSD yourself (article 34.4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Secretaría de Gobierno y Transformación Digital of the Presidencia del Consejo de Ministros (SGTD-PCM), which monitors and supervises how digital service providers meet their obligations under the Regulation.
Settledness
- As of
- Open questions
- Article 33.1 makes the official classification of incidents obligatory for notifying the CNSD, while article 33.3 lets a private provider take the classification only as a reference: which governs a private provider, and when does the Secretaría publish the periods for non-critical incidents?
What this law does
Article 18.1(a) of the Regulation requires such a provider to notify the Centro Nacional de Seguridad Digital (CNSD) of the digital-security incidents of its organization through the established protocols, channels and deadlines. Article 32.1 of the Regulation requires a critical-level incident to be notified to the CNSD within a maximum of forty-eight hours from when the provider becomes aware of it.
Article 32.2 of the Regulation requires an incident of any other classification to be notified within the periods the Secretaría de Gobierno y Transformación Digital sets. Article 31.2 of the Regulation requires the notification to contain at least a description of the incident, its classification and its impact.
Article 34.4 of the Regulation makes the provider responsible for notifying the CNSD of an incident, with its third-party service providers reporting to the provider the incidents under their control. Notifying the CNSD does not release the provider from notifying the Autoridad Nacional de Protección de Datos Personales where the incident compromised the personal data of its users. Supreme Decree 126-2025-PCM was published in the official gazette El Peruano on . The Regulation enters into force ninety calendar days after the day following its publication.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.