PeruLey 29733, cross-border transfer of personal data
Ley No. 29733, arts. 11, 15 (cross-border transfer)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before a cross-border transfer of personal data, confirm the destination country maintains an adequate level of protection under the Law, or, where it does not, guarantee as the sender that the processing will comply with the Law.
- Treat the adequate-protection requirement as met without a separate guarantee where the transfer falls under an international treaty Peru is party to, international judicial or anti-crime intelligence cooperation, performance of a contract the titleholder is party to, a banking or securities transaction, a medical or epidemiological purpose using dissociation, or the titleholder's prior, informed, express and unequivocal consent.
- Assess a cross-border transfer against a level of protection at least equivalent to this Law's own principles and to security and confidentiality measures appropriate to the data's category.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 11 requires a sufficient level of protection for cross-border flows and article 15 allows a flow only to a country with adequate protection, or with the sender guaranteeing processing under the Law, subject to listed exceptions including the data subject's prior, informed, express and unequivocal consent. Neither asks the sender to keep a record of the flow or of the consent. The communications of cross-border flows entered in the National Register are a filing made in article 34, which the row does not cite.
- Kind
- None
- As of
What this law does
Article 11 states the guiding principle that a cross-border transfer of personal data must guarantee a sufficient level of protection for the data to be processed, or, at minimum, a level comparable to what this Law or applicable international standards provide.
Article 15 operationalizes that principle: the titleholder and the processor of a cross-border data flow may carry it out only where the destination country maintains an adequate level of protection under the Law; where it does not, the sender of the transfer must instead guarantee the processing will comply with the Law.
That second requirement does not apply to eight listed cases: a transfer under an international treaty Peru is party to; international judicial cooperation; international cooperation between intelligence agencies against terrorism, drug trafficking, money laundering, corruption, human trafficking, or other organized crime; a transfer necessary to perform a contract the titleholder is party to, including user authentication, service improvement and support, quality monitoring, and account maintenance and billing support; a banking or securities transfer, for the respective transactions and under applicable law; a transfer for the titleholder's medical or surgical prevention, diagnosis, or treatment, or for an epidemiological or similar study using an adequate dissociation procedure; the titleholder's prior, informed, express, and unequivocal consent; and any other case the Law's regulation establishes, subject to article 12.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .