PeruProyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad
Proyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- Cooperate with public entities to maintain national cybersecurity where you operate as a private legal person in Peru (article 8).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The bill as introduced creates no criminal offense; Peru's existing computer-misuse offenses sit in Ley 30096 and are filed under this jurisdiction's scraping topic.
Who enforces it
Enforcement body
None: the bill as introduced creates no agency or authority with inspection or sanctioning power over the guidelines it would let the Comite de Ciberseguridad address to a private institution.
Settledness
- As of
- Open questions
- Has Proyecto de Ley 9906/2024-CR advanced past committee, been amended to add the incident-reporting clock and sanctioning agency a comparative commentary recommends, or lapsed, since the source's own date?
What this law does
Proyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on , would enact a standalone digital-security law. Its stated purpose, per the bill's own exposicion de motivos, is to strengthen information security in Peru against unlawful conduct that seeks to access, damage, or remove digital information belonging to a natural or legal person under public or private law alike.
Article 5 creates a Comite de Ciberseguridad that plans cyberattack-mitigation action lines for public institutions. Article 7 separately empowers that Comite to adopt guidelines addressed to a private institution to counter security breaches. Article 8 separately requires a public and a private entity to cooperate with each other to maintain national cybersecurity.
As introduced, the bill sets no incident-reporting clock and creates no agency with inspection or sanctioning power over a private institution's compliance, a gap a comparative commentary measures against Chile's Ley 21663 (Ley Marco de Ciberseguridad), which the same commentary names as the region's first cybersecurity framework law. The commentary the bill is read from is dated and describes no committee report or floor vote.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .