PeruReglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), exercise of data subject rights
Reglamento Ley 29733 (DS 016-2024-JUS) data subject rights, arts. 68-69, 71, 73, 75-76, 82-83, 86-87
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Answer a request to exercise a data-protection right within 8 days for information, 20 days for access and 10 days for rectification, cancellation or opposition, counted from the day after the request is filed, whether or not you hold the person's data; extend a period other than the one for information once, by an equal period at most, where circumstances justify it and tell the person within the period.
- Keep the means to prove that you answered a rights request in time and in clear, legible, understandable form.
- Where you refuse a rights request in whole or in part, justify the refusal and tell the person they may bring a claim before the Dirección de Protección de Datos Personales or a habeas data action before the Judiciary.
- On an access request, tell the person which of their data you process, how and why you collected them, at whose request, and what transfers you made or plan.
- On a portability request, give the personal data the person supplied in a structured, commonly used, machine-readable format and, where technically possible, transmit them directly to another controller, where the processing rests on consent or a contract or is automated; the portability duty took effect 6 months after the Regulation entered into force.
- On an erasure request, stop processing the data by blocking them while deletion is assessed, document to the person that the request was met and identify to whom the deleted data had been transferred.
- Stop processing for advertising, commercial prospecting and profiling when the person objects, unless a prior contractual relationship supports it.
- Tell a person as soon as possible when their data are processed as part of a decision-making process without their participation.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 68.4 makes the controller prove that it met the duty to respond to a rights request and requires it to keep the means to do so, and article 83 requires it to document to the person that an erasure request was met and to whom the data had been transferred. The articles name no log format, content or period, and give the Authority no express power to inspect the record.
- Kind
- Implicit
- As of
- Provision
- Article 68, point 4 and Article 83
- Trigger
- personal_data_processing
What this law does
Article 69 sets the maximum time to answer a rights request at 8 days for the right of information, 20 days for access, and 10 days for rectification, cancellation and opposition, counted from the day after the request is filed. Article 71 lets the time to answer a request other than one for information be extended once, by an equal period at most, where circumstances justify it, and requires the justification to be communicated to the data subject within the period being extended.
Article 68.4 makes the data bank holder or controller responsible for proving that it met the duty to respond, and requires it to keep the means of doing so. Article 73 requires a total or partial refusal of a rights request to be duly justified and to tell the data subject that a claim may be brought before the Dirección de Protección de Datos Personales or a habeas data action before the Judiciary.
Article 75.1 gives the data subject the right to be told, clearly and in simple language, which personal data are processed, how and why they were collected, at whose request, and what transfers were made or are planned. Article 76.1 gives the data subject a right to portability, to obtain the personal data the person supplied in a structured, commonly used, machine-readable format and have them transmitted to another controller, where processing rests on consent or a contract or is automated.
The first final complementary provision makes the portability right of Article 76 take effect 6 months after the Regulation enters into force. Article 82.3 makes the filing of an erasure request imply that processing of the data stops, through blocking, while later deletion is assessed. Article 83 requires the controller to document to the data subject that an erasure request was met and to identify to whom the deleted data had been transferred.
Article 86.4 lets the data subject object at any time to processing for advertising and commercial prospecting, including profiling, unless a prior contractual relationship supports the processing. Article 87.2 requires the controller to inform the data subject, as soon as possible, when personal data are processed as part of a decision-making process without the data subject's participation.
When LexLint raises it
When your app profile says your app processes personal data, sends automated outreach or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .