PeruReglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), cross-border flow of personal data
Reglamento Ley 29733 (DS 016-2024-JUS) cross-border flow, arts. 18-21
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Reporting
- Audit expectation
- none
What it requires
- Make a cross-border flow of personal data only to a receiver in a country with an adequate level of protection, which the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales determines by resolution; where the country has none, give adequate guarantees for the processing abroad, unless an exception in Article 15 of the Law applies.
- Where guarantees are needed, use model contractual clauses or other legal instruments that impose at least the same obligations the exporter is subject to, together with the conditions under which the data subject consented.
- Bring every cross-border flow of personal data to the attention of the Dirección General, with the information required for the transfer and for the data bank registration, using the approved format, so it is entered in the Registro Nacional de Protección de Datos Personales.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 18 to 20 set the adequacy and guarantee conditions for a flow and name no record, and article 21.2 requires the flow to be communicated to the Dirección General and entered in the National Register, which is a filing with the Authority and not a record the sender keeps. The optional opinion in article 21.1 asks for no record either.
- Kind
- None
- As of
What this law does
Article 18.1 of the Regulation requires a cross-border flow of personal data to be made when the receiver or importer is in a country with an adequate level of data protection under the Law and the Regulation. Article 18.2 requires the sender or exporter, where the country lacks an adequate level of protection, to give adequate guarantees for the processing outside Peru, except in the cases of Article 15 of the Law.
Article 19.1 has the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales issue a resolution determining whether a country has protection equivalent to the Law and the Regulation. Article 20.1 lets the exporter rely on model contractual clauses, or other legal instruments imposing at least the same obligations as the exporter's own and the conditions under which the data subject consented, as the guarantee.
Article 21.1 lets a data bank holder or controller ask the Dirección General for an opinion on whether its cross-border flow complies, to be issued within 30 days. Article 21.2 requires every cross-border flow of personal data to be brought to the attention of the Dirección General, with the information required for the transfer and for the data bank registration, and has the communication entered in the Registro Nacional de Protección de Datos Personales.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .