PeruRegulation of the Digital Trust Framework (Supreme Decree 126-2025-PCM), Digital-Security Risk Management and Controls
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds the public entities within the Regulation's scope and a private organization that provides a digital service in the financial, basic-service (electricity, water and gas), health, passenger-transport, internet-service, critical-activity or education sector in Peru (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services); a private organization outside those sectors treats the rules as reference only (article 12.2). The Regulation enters into force ninety calendar days after the day following its publication in El Peruano on , which is .
- Manage the digital-security risks in your organization so as to set controls that protect the confidentiality, integrity and availability of information (article 14.1).
- Implement security controls and measures in providing your digital services according to your risk assessment, widely recognized practices, the national regulatory framework and international standards (article 18.1(b)).
- Maintain a secure, scalable and interoperable infrastructure that guarantees the confidentiality, availability and integrity of your digital services (article 18.1(f)).
- Test your digital services proactively for vulnerabilities so as to identify digital-security risks (article 18.1(i)).
- If a law or special rule also regulates your service, comply with your sector's rules first; the Regulation applies to what they do not provide (article 18.2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Secretaría de Gobierno y Transformación Digital of the Presidencia del Consejo de Ministros (SGTD-PCM), which monitors and supervises how digital service providers meet their obligations under the Regulation.
Settledness
- As of
- Open questions
- Which private organizations beyond those the Regulation lists fall within the services named in article 9.1 of Decreto de Urgencia 007-2020, which the Regulation's article 12.1 cross-refers to?
What this law does
Article 14.1 of the Regulation requires digital service providers in the financial, basic-service, health, passenger-transport, internet-service, critical-activity and education sectors to manage digital-security risks in their organization so as to set controls that protect the confidentiality, integrity and availability of information.
Article 18.1(b) of the Regulation requires such a provider to implement security controls and measures in providing its digital services according to its risk assessment. Article 18.1(f) of the Regulation requires such a provider to maintain a secure, scalable and interoperable infrastructure. Article 18.1(i) of the Regulation requires such a provider to test its digital services proactively for vulnerabilities.
Where a provider is also regulated by a law or special rule, article 18.2 of the Regulation requires it to comply with its sector rules, and the Regulation then applies only in what those rules do not provide. A private organization outside the scope of Decreto de Urgencia 007-2020 treats the Regulation as reference only. Article 15 of the Regulation leaves it to a private entity whether to designate a digital security and trust officer.
Supreme Decree 126-2025-PCM was published in the official gazette El Peruano on . The Regulation enters into force ninety calendar days after the day following its publication.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.