PeruReglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), enforcement measures, coercive fines and infractions
Reglamento Ley 29733 (DS 016-2024-JUS) enforcement and sanctions, arts. 121-122, 124, 129-134
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Expect the Dirección de Protección de Datos Personales, once a sanctioning procedure has begun, to order provisional or precautionary measures and, alongside a sanction, corrective measures such as ceasing processing of data obtained disproportionately or without consent, deleting data obtained without consent, and immediately attending a right the data subject requested.
- Expect an automatic coercive fine, without prior demand, for failing to comply with a corrective or precautionary measure: up to 2 UIT for a minor, 2 to 6 UIT for a serious and 6 to 10 UIT for a very serious infraction, doubling successively up to 100 UIT while the failure persists.
- Where charged, prove in the reply the gross annual income received in the year before the infraction as the second paragraph of Article 39 of the Law provides.
- Expect a minor infraction for failing to communicate a cross-border flow for registration or to designate a Personal Data Officer where required; a serious infraction for processing without the required consent, for failing to notify a security incident under Article 34, and for refusing the Authority access or the documents it requests in an inspection; and a very serious infraction for processing by fraudulent, unfair or unlawful means.
- Expect those sanctioned, and the precautionary and corrective measures, to be recorded in the Registro Nacional de Protección de Datos Personales and published on the Ministry of Justice and Human Rights digital site.
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights
What it makes you log
Logging duty
Articles 121 to 134 set the measures, fines and infractions the Authority applies. Article 133, point 9 makes it a serious infraction to refuse the Authority the information or documents on processing that it requests in an inspection or pending proceeding, which is a power to demand information and names no log, register or record the party keeps. The register of sanctions in article 129 is kept by the Authority.
- Kind
- None
- As of
What this law does
Article 121.1 lets the Dirección de Protección de Datos Personales, once a sanctioning procedure has begun and at the request of the Dirección de Fiscalización e Instrucción, order provisional measures that secure the effect of the final decision.
Article 122.2 lets the Dirección de Protección de Datos Personales order corrective measures, including ceasing processing of data obtained disproportionately or without consent, deleting data obtained without consent, and immediately attending the right the data subject requested. Article 124.1 lets a respondent prove, in its reply to the charges, the gross annual income it received in the year before the infraction, in the manner the second paragraph of Article 39 of the Law provides.
Article 129 has the Registro Nacional de Protección de Datos Personales record those sanctioned under the Law and the Regulation, and the precautionary and corrective measures, and has them published on the digital site of the Ministry of Justice and Human Rights.
Article 130.1 has the Dirección de Protección de Datos Personales impose coercive fines automatically, without prior demand, for failure to comply with corrective and precautionary measures, up to 2 UIT for minor, 2 to 6 UIT for serious and 6 to 10 UIT for very serious infractions. Article 130.2 lets a new coercive fine be imposed where the failure persists, doubling the last fine successively up to 100 UIT.
Article 132 makes failing to communicate a cross-border flow to the Dirección de Protección de Datos Personales for registration, and failing to designate a Personal Data Officer where required, minor infractions. Article 133 makes processing personal data without the free, express, unequivocal, prior and informed consent of the data subject, where required, a serious infraction.
Article 133 makes unjustifiably refusing to give the Autoridad Nacional de Protección de Datos Personales the information or documents on processing that it requests in an inspection or pending proceeding a serious infraction. Article 133 makes failing to notify the Autoridad Nacional de Protección de Datos Personales of a personal-data security incident, where Article 34 of the Regulation requires it, a serious infraction. Article 134 makes processing personal data by fraudulent, unfair or unlawful means a very serious infraction.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .