PeruReglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), security incidents and access records
Decreto Supremo No. 016-2024-JUS Reglamento de la Ley No. 29733, Ley de Protección de Datos Personales, arts. 34-36 and 46 (security-incident notice and documentation; records of interactions with personal data)
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Breach notice, Security
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- Notify the Autoridad Nacional de Protección de Datos Personales within 48 hours of learning of a personal-data security incident that exposes large volumes of data, may affect a large number of people, involves sensitive data or clearly harms other rights of the data subject, and give the reasons and supporting evidence where the notice comes later than 48 hours.
- Tell the data subject within 48 hours, without undue delay and in plain language, of a security incident that affects other rights of the data subject, together with the measures adopted to mitigate its effects.
- Document every security incident, including the related facts, its effects and the measures adopted, so that the Authority can verify compliance.
- As a processor, inform the data bank holder or controller immediately of a security incident the processor learns of.
- Generate and keep records of interactions with personal data in each platform, website, mobile application, digital service or system used to process it, covering the user accounts with access, session start and end times and the actions of processing, viewing, modification, deletion, import and export, and keep them for at least two years.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Log retention
The two-year minimum in Article 46, point 3 applies to the records of interactions with personal data in the digital systems used for processing. Article 35 sets no period for keeping the incident documentation.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 2
Logging duty
Article 35 requires the controller to document every security incident, including the facts, its effects and the measures adopted, and says that this documentation lets the Authority verify compliance. Article 46, point 3 requires the systems used to process personal data to generate and keep records of interactions with the data (accounts with access, session start and end times, and the actions of processing, viewing, modification, deletion, import and export), kept for at least two years, with the records of operators' actions generated continuously and available immediately. Article 34 on its own only requires notice of an incident to the Authority and the data subject and sets no record, so it is not the source of the duty. The Regulation has no register of processing activities: the National Registry of Personal Data Protection (articles 42 to 44) is a filing the Authority keeps, and the security document of article 47 is a policy, so neither is coded as a log. The part of the territorial scope clause that turns on where processing means are located gives no hook value.
- Kind
- Explicit
- As of
- Provision
- Article 35 (documentation of security incidents) and Article 46, point 3 (records of interactions with personal data)
- Trigger
- personal_data_processing
- security_incident
What this law does
Article 34 requires the holder of a personal-data bank or the controller to notify the Autoridad Nacional de Protección de Datos Personales within 48 hours of becoming aware of a security incident that exposes large volumes of personal data, may affect a large number of people, involves sensitive data or clearly harms other rights of the data subject.
Article 34 also requires the same party to tell the data subject within 48 hours, without undue delay and in plain language, of a security incident that affects the data subject's other rights. Article 35 requires the controller to document any security incident, including the related facts, its effects and the measures adopted. Article 36 requires a processor to inform the data bank holder or controller immediately of a security incident it learns of.
Article 46 requires the platforms, websites, mobile applications, digital services and information systems used to process personal data to generate and keep records of interactions with the data, including the user accounts with access, session start and end times and the actions of processing, viewing, modification, deletion, import and export. Those interaction records must be kept for a minimum period of two years.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.