PeruReglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), sensitive data and the data of children and adolescents
Reglamento Ley 29733 (DS 016-2024-JUS) sensitive data and children, arts. 8, 22-23, 25
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent
- Audit expectation
- none
What it requires
- Obtain consent to process sensitive data in writing, by handwritten, digital or electronic signature or another form that guarantees the data subject's will, in addition to meeting the requirements of valid consent.
- Process a child's or adolescent's data only with the consent of the person holding parental authority or guardianship, or, for a person over fourteen and under eighteen, with the person's own consent according to capacity where the information is given in language the person understands; for digital services, over fourteen and under eighteen consent for themselves and under fourteen needs the parent or guardian.
- Do not take a child's consent as a way to give the child access to activities tied to goods or services restricted for the child's age.
- Do not collect from a child or adolescent data that reveal information about other members of the family group, such as the parents' occupation or economic information, without those persons' consent; collect only the parents' or guardians' identity and address, where needed, to obtain consent.
- On digital platforms and services, make reasonable efforts, taking available technology into account, to verify the identity of those who give consent for a child or adolescent.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 8, 22, 23 and 25 set conditions on consent and on collection for sensitive data and for the data of children and adolescents. Article 8 requires the consent to be in writing, which is a condition of processing, and article 25.4 requires reasonable efforts to verify the identity of those who consent, a verification step with no record, log or period named. The proof of consent in article 9 sits in the comprehensive-regime row, outside this row.
- Kind
- None
- As of
What this law does
Article 8 of the Regulation requires consent to the processing of sensitive data, besides meeting the requirements of valid consent, to be given in writing by handwritten, digital or electronic signature or another form that guarantees the data subject's will.
Article 22.1 and 22.2 make processing of the data of children and adolescents lawful when the consent of those holding parental authority or guardianship is obtained, and let a person over fourteen and under eighteen consent according to capacity where the information is given in language the person understands.
Article 22.3 bars consent to the processing of a child's or adolescent's data from being given so that the child can access activities linked to goods or services restricted for the child's age. Article 23.1 bars collecting a child's or adolescent's data that reveal information about other members of the family group, such as the parents' occupation or economic information, without those persons' consent.
Articles 25.2 and 25.3 make processing in digital services offered to persons over fourteen and under eighteen lawful with their own consent, and processing in digital services aimed at children under fourteen lawful with the consent of those holding parental authority or guardianship.
Article 25.4 requires the holder or controller on digital platforms and services to make reasonable efforts, taking available technology into account, to verify the identity of those who give consent in those cases.
When LexLint raises it
When your app profile says your app processes personal data or serves under-18s.
Back to the example · Lint your app
Page updated .