PeruLey 29733, enforcement, supervisory authority and sanctions
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Expect the Autoridad Nacional de Protección de Datos Personales, within the Ministry of Justice and Human Rights, to open an investigation on its own initiative or on complaint, resolve titleholders' claims, and order precautionary or corrective measures or an administrative sanction for a breach of the Law or its regulation.
- Register your personal-data bank in the Registro Nacional de Protección de Datos Personales, and expect any cross-border data-flow communication, sanction, or precautionary or corrective measure to be recorded there too.
- Expect a fine of 0.5 to 5 Tax Units (UIT) for a minor infraction, more than 5 up to 50 UIT for a serious infraction, or more than 50 up to 100 UIT for a very serious infraction, capped at ten percent of your gross annual income for the preceding fiscal year, without prejudice to separate civil or criminal liability.
- Comply with an accessory obligation the sanctioning procedure imposes within its deadline, or expect a coercive fine of up to 10 UIT on top of the underlying sanction.
- Expect the constitutional habeas data process to remain open to a titleholder independently of, and without first requiring, the Law's own administrative procedure before the Authority.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Law's own sanctioning scheme is administrative, through fines imposed by the Autoridad Nacional de Protección de Datos Personales; it states that this does not preclude civil damages or criminal sanctions that may separately apply under other law, but it does not itself create a criminal offense for violating its personal-data duties.
Who enforces it
Enforcement body
Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 32 to 40 make the Ministry of Justice the Authority and give it administrative, supervisory and sanctioning functions. Article 33(18) lets it obtain from data bank owners, within a pending administrative proceeding, the information it considers necessary, and article 33(20) lets it open inspections on its own initiative or on complaint. That is a power to demand information and inspect, with no log, register or record named, so no record duty is imposed and the Authority's power is the audit expectation. The sanction articles (37 to 40) and the habeas data clause (sixth final complementary provision) name no record either. Article 33(3) and article 34 have the Authority keep the National Register, a filing and not a record the titleholder keeps.
- Kind
- None
- As of
What this law does
Article 32 makes the Ministry of Justice, through its Dirección Nacional de Justicia, the Autoridad Nacional de Protección de Datos Personales, empowers it to open offices nationwide, and gives it sanctioning power under the general administrative-procedure law and coercive power under the coercive-execution law.
Article 33 lists the Authority's functions, including representing Peru internationally on data protection, cooperating with foreign authorities, administering the Registro Nacional de Protección de Datos Personales, publishing the registry of public and private data banks, promoting protection of children's and adolescents' data, issuing technical opinions on draft rules touching personal data that are binding, resolving titleholders' claims and ordering precautionary or corrective measures, and opening investigations on its own initiative or on complaint and applying the corresponding administrative sanctions.
Article 34 creates the Registro Nacional de Protección de Datos Personales to record public and private data banks, cross-border data-flow communications, and the sanctions and precautionary or corrective measures the Authority imposes, open to public consultation as to a bank's existence, purpose, and ownership.
Article 35 binds Authority personnel to confidentiality that survives their tenure, and article 36 funds the Authority from administrative fees, fine proceeds, international technical cooperation, and legacies and donations.
Article 37 lets the sanctioning procedure open on the Authority's own initiative or on a complaint, with its resolutions exhausting the administrative channel and reviewable only through a contencioso-administrativo action; article 38 has the regulation classify infractions as minor, serious, or very serious and lets the Authority order corrective measures alongside a sanction, holding a respondent strictly liable for a breach of personal-data-protection duties.
Article 39 sets three fine tiers, a minor infraction from 0.5 to 5 Tax Units (UIT), a serious infraction from more than 5 to 50 UIT, and a very serious infraction from more than 50 to 100 UIT, with the fine never exceeding ten percent of the offender's gross annual income for the prior fiscal year, without prejudice to any disciplinary, civil, or criminal liability that separately applies; and article 40 lets the Authority impose coercive fines of up to 10 UIT for failing to comply with an accessory obligation the sanctioning procedure imposed.
Disposición complementaria final sexta keeps the constitutional habeas data process, under the Código Procesal Constitucional, independent of the Law's own administrative procedure, and states that the administrative procedure is not a precondition for pursuing the constitutional action, so the Law does not itself arm a titleholder with a private cause of action beyond its own administrative channel and that separate constitutional remedy.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .