PeruLey 29733, rights of the data subject
Ley No. 29733, arts. 18-22 and 24-27 (rights of the data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.NIST Privacy FrameworkCM.AW-P1
- Tell a person when you engage a new processor after they gave consent, or when a merger, portfolio acquisition, or similar transfer gives their data a new data-bank owner.NIST Privacy FrameworkCM.AW-P1
- Give a person access, on request, to the personal data you hold on them, how you collected it, why, at whose request, and what transfers you made or plan to make.NIST Privacy FrameworkCT.DM-P1
- Correct, update, include, or delete a person's personal data on request when it is inaccurate, incomplete, or has outlived the purpose or period for which it was collected, tell anyone you previously transferred it to about the change, and block the data from third-party access while the request is pending.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Stop supplying a person's personal data to others on their request to prevent supply, especially where the supply would affect a fundamental right.NIST Privacy FrameworkCT.PO-P3
- Stop processing a person's personal data on a well-founded, legitimate objection tied to their specific situation, absent their consent, and delete the data where the objection is justified.NIST Privacy FrameworkCT.PO-P3
- Let a person bring an unanswered or denied rights request to the Autoridad Nacional de Protección de Datos Personales or to the Judiciary through a habeas data action, and expect to compensate them for harm your breach of the Law causes.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 19 gives the data subject a right to learn how their data were collected, the reasons for collecting them, at whose request the collection was made, and the transfers made or planned. A titleholder cannot answer that without keeping a record of each collection and transfer, though the Law names no log. Articles 18, 20 to 22 and 24 to 27 state the rights to information, updating, blocking, opposition, redress and compensation, with the limits for public-administration banks, and name no record or authority access. The cited articles carry no territorial clause.
- Kind
- Implicit
- As of
- Provision
- Article 19
- Trigger
- personal_data_processing
What this law does
Article 18 gives the titleholder a right to be informed, in detailed, simple, express, and unequivocal terms before their data is collected, of the processing's purpose, its recipients, the data bank's existence and its owner's identity and address, whether answering is mandatory or optional, any transfer, the retention period, and how to exercise their rights, and lets a controller collecting data online satisfy this through an easily accessible and identifiable privacy policy; it also requires notice to the titleholder of a new processor engaged after consent was given, or of a new data-bank owner following a merger, portfolio acquisition, or similar transfer.
Article 19 gives a right of access to the information processed about oneself, how it was collected, why, at whose request, and what transfers were made or are planned.
Article 20 gives a right to update, include, rectify, or delete personal data that is inaccurate, incomplete, or obsolete, requires the processor to pass the correction on to anyone the data were previously transferred to, and requires the processor to block the data during the update, inclusion, rectification, or deletion process so no third party can access it, with an exception for a public entity that needs the data for its own competencies.
Article 21 gives a right to prevent the data from being supplied to others, especially where that would affect a fundamental right, though it does not reach the internal relationship between a data bank's owner and its processor. Article 22 gives a right to object to processing, absent the titleholder's consent, on well-founded and legitimate grounds tied to a specific personal situation, requiring deletion where the objection is justified.
Article 24 lets a titleholder whose rights are denied bring a claim to the Autoridad Nacional de Protección de Datos Personales, whose resolution exhausts the administrative channel and opens the door to a contencioso-administrativo action, or pursue a constitutional habeas data action before the Judiciary instead. Article 25 gives a right to compensation for harm the Law's breach causes.
Article 26 sets the fee for exercising these rights before a public-administration data bank by the general administrative-procedure law and leaves a private data bank's fee to special rules.
Article 27 lets a public-administration titleholder or processor deny access, deletion, or objection on grounds tied to protecting a third party's rights, or to avoid obstructing a pending judicial or administrative proceeding on tax, welfare, criminal, health, environmental, or administrative-infraction matters, or where the law otherwise so provides.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .