Ley 29733, Ley de Protección de Datos Personales

Article 1 states the Law's object as guaranteeing the constitutional right to personal-data protection, and article 3 applies it to personal data contained or destined to be contained in a personal-data bank of public or private administration whose processing takes place within Peru, excluding a bank a natural person creates for purposes exclusively related to their private or family life and, within the limits it states, a public-administration bank's processing that is strictly necessary for the competencies the law assigns the entity, national defense, public security, or criminal investigation and prosecution.

Articles 4 through 10 and 12 state the Law's guiding principles: legality (no collection by fraudulent, unfair, or unlawful means), consent, purpose limitation, proportionality, quality (data must be truthful, accurate, and kept only as long as the purpose requires), security, and a right of recourse, and article 12 makes the principles interpretive criteria for the whole Law and its regulation.

Article 13 requires the titleholder's prior, informed, express, and unequivocal consent for ordinary processing, revocable at any time under the same requirements as its grant, and article 14 lists the cases where consent is not required, including processing by a public entity within its own competencies, data from publicly accessible sources, and processing necessary to perform a contract the titleholder is party to.

Article 16 requires the data bank's owner to adopt technical, organizational, and legal measures that guarantee security and prevent unauthorized alteration, loss, processing, or access, and bars processing in a data bank that does not meet the Authority's security requirements, while article 17 binds the data bank's owner, its processor, and anyone else who takes part in the processing to confidentiality that survives the end of their relationship with the owner.

Article 28 lists the titleholder's and processor's general obligations, echoing the consent, purpose-limitation, and deletion duties, and requiring cooperation with the Authority's information requests in a pending administrative proceeding.

Article 29 conditions a personal-data bank's creation, modification, or cancellation on the regulation and guarantees public access to its existence, purpose, and ownership; article 30 requires a processor handling data under a service contract to use it only for the contracted purpose, not transfer it further, and delete it once the contract is performed, absent authorization to retain it against a likely further engagement; and article 31 lets private-sector representative bodies adopt conduct codes for their members.

The Law's fifth complementary final provision requires a personal-data bank created before the Law and its regulations to conform to this Law within the deadline the regulation sets, and requires the bank's owner to declare it to the Autoridad Nacional de Protección de Datos Personales, subject to article 29.

The current implementing regulation is Decreto Supremo No. 016-2024-JUS, published 30 November 2024; its own operative text is not reproduced here, so no specific provision of it beyond its existence and publication date is described here.