LexLint.ioBeta

Know the law your code answers to.

Law / Peru

Ley 29733, Ley de Protección de Datos Personales

Ley No. 29733 Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017), arts. 1-10, 12-14, 16-17, 28-31 (object, definitions, scope, principles, lawful processing, security, confidentiality, and personal-data-bank obligations)

In force since .

A comprehensive regime rule binding public and private bodies.

Obligation class
Consent, Security, Governance, Retention
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Obtain a person's prior, informed, express, and unequivocal consent before processing their personal data, unless a law authorizes the processing without it, and let them revoke that consent at any time under the same requirements that applied when they gave it.NIST Privacy FrameworkCT.PO-P1
  • Do not collect personal data by fraudulent, unfair, or unlawful means, and collect only data that is updated, necessary, relevant, and adequate to a determined, explicit, and lawful purpose stated at the time of collection.NIST Privacy FrameworkGV.PO-P1
  • Do not use personal data for a purpose other than the one that justified its collection, unless you first apply an anonymization or dissociation procedure.NIST Privacy FrameworkGV.PO-P1
  • Adopt technical, organizational, and legal measures that guarantee the security of personal data and prevent its alteration, loss, unauthorized processing, or access, and do not process personal data in a data bank that does not meet the Authority's security requirements.NIST Privacy FrameworkPR.DS-P5
  • Keep confidential any personal data you hold or process, and continue to do so even after your relationship with the data bank's owner ends.NIST Privacy FrameworkPR.PO-P9
  • Register your personal-data bank with the Registro Nacional de Protección de Datos Personales before creating it, or, for a bank that predates the Law, declare it to the Authority within the deadline the regulation sets.NIST Privacy FrameworkGV.PO-P5
  • As a processor handling personal data under contract for a third party, use it only for the purpose the contract states, do not transfer it to anyone else, and delete it once the contract is performed unless the data bank's owner authorized retaining it against a likely further engagement.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkCT.DM-P5

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.DM-P5Data are destroyed according to policy.
  • PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
FINOS AIGF
7 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

Articles 1 to 10, 12 to 14, 16, 17 and 28 to 31 state principles, consent, security, confidentiality and the owner's duties, and ask for no log, register or proof kept by the titleholder. Article 13.6 requires consent to processing sensitive data to be given in writing, which is a condition of processing and states no record to keep. Article 28(8) makes the titleholder and processor give the Authority the information on the processing it requests, and access to the data banks, within a pending administrative proceeding, a power to demand information with no record named. Article 29 publicizes a data bank's existence, purpose and owner and article 30 limits a processor's retention of the data, which concern the data and a filing rather than a log. Article 3 applies the Law to data banks whose processing takes place in the national territory; that location test takes no hook value.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 1 states the Law's object as guaranteeing the constitutional right to personal-data protection, and article 3 applies it to personal data contained or destined to be contained in a personal-data bank of public or private administration whose processing takes place within Peru, excluding a bank a natural person creates for purposes exclusively related to their private or family life and, within the limits it states, a public-administration bank's processing that is strictly necessary for the competencies the law assigns the entity, national defense, public security, or criminal investigation and prosecution.

Articles 4 through 10 and 12 state the Law's guiding principles: legality (no collection by fraudulent, unfair, or unlawful means), consent, purpose limitation, proportionality, quality (data must be truthful, accurate, and kept only as long as the purpose requires), security, and a right of recourse, and article 12 makes the principles interpretive criteria for the whole Law and its regulation.

Article 13 requires the titleholder's prior, informed, express, and unequivocal consent for ordinary processing, revocable at any time under the same requirements as its grant, and article 14 lists the cases where consent is not required, including processing by a public entity within its own competencies, data from publicly accessible sources, and processing necessary to perform a contract the titleholder is party to.

Article 16 requires the data bank's owner to adopt technical, organizational, and legal measures that guarantee security and prevent unauthorized alteration, loss, processing, or access, and bars processing in a data bank that does not meet the Authority's security requirements, while article 17 binds the data bank's owner, its processor, and anyone else who takes part in the processing to confidentiality that survives the end of their relationship with the owner.

Article 28 lists the titleholder's and processor's general obligations, echoing the consent, purpose-limitation, and deletion duties, and requiring cooperation with the Authority's information requests in a pending administrative proceeding.

Article 29 conditions a personal-data bank's creation, modification, or cancellation on the regulation and guarantees public access to its existence, purpose, and ownership; article 30 requires a processor handling data under a service contract to use it only for the contracted purpose, not transfer it further, and delete it once the contract is performed, absent authorization to retain it against a likely further engagement; and article 31 lets private-sector representative bodies adopt conduct codes for their members.

The Law's fifth complementary final provision requires a personal-data bank created before the Law and its regulations to conform to this Law within the deadline the regulation sets, and requires the bank's owner to declare it to the Autoridad Nacional de Protección de Datos Personales, subject to article 29.

The current implementing regulation is Decreto Supremo No. 016-2024-JUS, published ; its own operative text is not reproduced here, so no specific provision of it beyond its existence and publication date is described here.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .