PeruReglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), consent, data protection officer and registration of data banks
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance
- Audit expectation
- none
What it requires
- Obtain consent to process personal data that is free, prior, express and unequivocal, and informed, asking for it before collecting the data or before a use different from the one the data were collected for; do not condition a service on data that is not indispensable to it.
- Do not treat publishing a privacy policy as a substitute for the data subject's consent.
- Prove consent whenever it is questioned: as holder of the data bank or controller, bear the burden of proof of consent in every case.
- Provide an easily accessible, unconditional, simple, quick and free way for a person to revoke consent.
- Designate a Personal Data Officer, publish the officer's contact details and tell the Autoridad Nacional de Protección de Datos Personales of them within 15 days, where a public entity processes the data, where the processing involves large volumes of data, sensitive data or evident harm to other rights, or where sensitive-data processing is a main business activity; in the cases of Article 37.1, points 2 and 3, the duty phases in by annual sales over four years from publication of the Regulation.
- Register the creation, modification or cancellation of a personal-data bank with the Registro Nacional de Protección de Datos Personales.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 9 puts the burden of proving consent, in every case, on the holder of the data bank or the controller, which a party can meet only by keeping evidence of the consent it relied on, though the article names no log or period. Article 42 is a registration filed with the Authority and article 37.5 a notice of the officer's contact details, neither a record the party keeps. The articles carry no territorial clause.
- Kind
- Implicit
- As of
- Provision
- Article 9
- Trigger
- consent_or_optout
What this law does
Article 2 of the Regulation makes consent to the processing of personal data valid only when it is free, prior, express and unequivocal, and informed. Article 3.2 treats conditioning a service, or threatening to deny access to benefits or services that are normally unrestricted, as affecting the freedom of consent where the data requested are not indispensable to the service.
Article 7 states that publishing a privacy policy complies with the duty of information and the transparency principle but does not remove the requirement to obtain the data subject's consent. Article 9 places the burden of proving consent, in every case, on the holder of the personal-data bank or the controller.
Article 10.4 requires the holder of the personal-data bank or the controller to provide mechanisms that are easily accessible, unconditional, simple, quick and free to make a revocation of consent effective.
Article 37.1 requires a data bank holder, controller or processor to designate a Personal Data Officer where a public entity carries out the processing, where the processing involves large volumes of personal data, sensitive data or evident harm to other rights of the data subject, or where the party's main business activities involve processing sensitive data.
Article 37.5 requires the contact details of the designated officer, and any update, to be communicated to the Autoridad Nacional de Protección de Datos Personales within 15 days. The first final complementary provision phases in the officer duty in the cases of Article 37.1, points 2 and 3, by annual sales, from one year after publication of the Regulation for companies with sales above 2,300 UIT to four years after publication for micro-enterprises with sales up to 150 UIT.
Article 42.1 requires private-sector persons and public entities that create, modify or cancel personal-data banks to process the registration of those acts with the Registro Nacional de Protección de Datos Personales. The first final complementary provision brings the Regulation into force 120 calendar days after its publication in the official gazette El Peruano.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .