PeruLey 30096, unauthorized access and data/system integrity offenses
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer system, in whole or in part, without authorization or beyond what you are authorized to access; defeating a security measure to do so draws a higher penalty tier.NIST AI RMFMAP 4.1
- Do not damage, introduce, delete, deteriorate, alter, suppress, or make inaccessible another party's computer data.no control in the NIST AI RMF
- Do not disable a computer system, impede access to it, or hinder or prevent its operation or the provision of its services.no control in the NIST AI RMF
- Do not intercept non-public computer data transmissions without authorization.NIST AI RMFMAP 4.1
- Do not design, sell, distribute, or obtain a tool, password, or access code specifically to commit one of these offenses.no control in the NIST AI RMF
- Expect a sentencing enhancement of up to one-third above the legal maximum where an offense under this Law is committed using artificial intelligence or a similar technology.
- Conduct under articles 2, 3, 4, or 10 carried out to run an authorized test or other authorized procedure to protect computer systems is exempt from criminal liability.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 2: one to four years' imprisonment and 30 to 90 day-fines for unauthorized access; three to six years and 80 to 120 day-fines where a security measure is defeated. Articles 3, 4, and 7: three to six years' imprisonment and 80 to 120 day-fines. Article 11 raises any of these sentences by up to one-third above the legal maximum on an aggravating circumstance, including an offense committed using artificial intelligence or a similar technology.
Who enforces it
Enforcement body
Ministerio Público (Peru's Public Prosecutor's Office) and the Poder Judicial, through ordinary criminal prosecution
What it makes you log
Logging duty
Articles 2 to 4 (illegal access, interference with data, interference with systems), 7 (interception), 10 (abuse of devices), 11 (aggravations) and 12 (exemption from criminal liability) punish conduct and set no duty to create, keep or produce a log or record. The Law's final provisions amend article 230 of the Código Procesal Penal so that telecommunications concessionaires must, on a judicial order, give subscriber identity and call-traffic and IP data, which is a procedural duty outside the cited articles and states no retention period. The Law has no territorial clause.
- Kind
- None
- As of
What this law does
Article 2 punishes deliberately and illegitimately accessing all or part of a computer system, or exceeding authorized access, with one to four years' imprisonment and thirty to ninety day-fines; the penalty rises to three to six years' imprisonment and eighty to one hundred twenty day-fines where the agent defeats a security measure to gain access.
Article 3 punishes deliberately and illegitimately damaging, introducing, deleting, deteriorating, altering, suppressing, or making inaccessible computer data, and article 4 punishes deliberately and illegitimately disabling a computer system in whole or in part, impeding access to it, or hindering its operation or the provision of its services, each with three to six years' imprisonment and eighty to one hundred twenty day-fines.
Article 7 punishes deliberately and illegitimately intercepting non-public computer data transmissions to, from, or within a computer system. Article 10 punishes fabricating, designing, developing, selling, facilitating, distributing, importing, or obtaining a mechanism, program, device, password, access code, or other computer data specifically designed to commit one of the Law's offenses.
Article 11 raises the sentence by up to one-third above the legal maximum for any of these offenses where an aggravating circumstance applies, including, since Ley 32314 (), where the agent commits the offense using artificial intelligence or a similar or analogous technology. Article 12 exempts from criminal liability conduct described in articles 2, 3, 4, or 10 undertaken to carry out an authorized test or other authorized procedure to protect computer systems.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .