Peru

Article 22 classifies AI risk into two named categories, uso indebido (misuse, deemed prohibited by definition) and high-risk use, and treats every other use as acceptable risk. Article 23 deems it misuse to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter behavior.

It is also misuse to generate an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting. Carrying out mass surveillance without a legal basis or where it generates or may generate a disproportionate impact on the exercise of fundamental rights is misuse as well.

So is analyzing, classifying, or inferring a person's sensitive data from their biometric data to deduce racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation, or evaluating or classifying natural persons or groups in a way that produces discriminatory or disproportionate results violating fundamental rights.

Carrying out real-time biometric identification to categorize natural persons in public spaces is misuse too, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes. Predicting that a natural person will commit a crime based on profiling or an assessment of personality traits is likewise misuse.

Article 23.4 excepts, specifically from the real-time biometric identification prohibition, a system that supports a human evaluator's assessment of a person's involvement in an existing criminal activity, provided the assessment rests on objective, verifiable facts and the system carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination.

The Regulation applies to public-administration entities and to private-sector organizations, civil society, citizens, and academia, and enters into force ninety business days after its publication. It creates no sanctioning regime of its own for a breach of these prohibitions distinct from referring suspected violations to the competent authority.

Article 24 classifies an AI-based system's use as high-risk where, among other criteria, it manages critical national assets supporting essential services (energy, telecommunications, health, transport, water, and banking, among others) or is used to evaluate a person in a selection process. A developer or implementer may ask the SGTD to determine whether a use falls within the high-risk category.

Article 25 requires the developer or implementer of a high-risk system to establish mechanisms guaranteeing algorithmic transparency, informing the user beforehand, clearly and simply, of the system's purpose or use, its main functions, and the kind of decisions it can make, and, where the system's decisions affect human rights, to explain its results to affected users in accessible language.

For a private-sector developer or implementer, article 25's transparency duty and a related Title VI chapter phase in gradually by sector, starting the day after the Decreto Supremo's publication: one year for AI uses in health, education, justice, security, and economy-finance; two years for transport, commerce, and labor; three years for production, agriculture, energy, and mining; and four years for every other use nationwide, with a further, longer schedule for small businesses and innovative start-ups.

Public-sector entities implement article 25 on their own graduated schedule, running from one to three years after the Decreto Supremo's publication depending on the type of entity; only for the smallest local governments (Tipo D, E, F, and G) is implementing article 25 described as facultative, according to their resources and capacities.

Article 26 requires compliance with the personal-data and privacy rules in force for any high-risk system's development, implementation, or use, and states that liability for a breach of those data-protection duties is determined under Ley No. 29733's own sanctioning regime rather than under this Decreto Supremo.

Article 1 states the Law's object as guaranteeing the constitutional right to personal-data protection, and article 3 applies it to personal data contained or destined to be contained in a personal-data bank of public or private administration whose processing takes place within Peru, excluding a bank a natural person creates for purposes exclusively related to their private or family life and, within the limits it states, a public-administration bank's processing that is strictly necessary for the competencies the law assigns the entity, national defense, public security, or criminal investigation and prosecution.

Articles 4 through 10 and 12 state the Law's guiding principles: legality (no collection by fraudulent, unfair, or unlawful means), consent, purpose limitation, proportionality, quality (data must be truthful, accurate, and kept only as long as the purpose requires), security, and a right of recourse, and article 12 makes the principles interpretive criteria for the whole Law and its regulation.

Article 13 requires the titleholder's prior, informed, express, and unequivocal consent for ordinary processing, revocable at any time under the same requirements as its grant, and article 14 lists the cases where consent is not required, including processing by a public entity within its own competencies, data from publicly accessible sources, and processing necessary to perform a contract the titleholder is party to.

Article 16 requires the data bank's owner to adopt technical, organizational, and legal measures that guarantee security and prevent unauthorized alteration, loss, processing, or access, and bars processing in a data bank that does not meet the Authority's security requirements, while article 17 binds the data bank's owner, its processor, and anyone else who takes part in the processing to confidentiality that survives the end of their relationship with the owner.

Article 28 lists the titleholder's and processor's general obligations, echoing the consent, purpose-limitation, and deletion duties, and requiring cooperation with the Authority's information requests in a pending administrative proceeding.

Article 29 conditions a personal-data bank's creation, modification, or cancellation on the regulation and guarantees public access to its existence, purpose, and ownership; article 30 requires a processor handling data under a service contract to use it only for the contracted purpose, not transfer it further, and delete it once the contract is performed, absent authorization to retain it against a likely further engagement; and article 31 lets private-sector representative bodies adopt conduct codes for their members.

The Law's fifth complementary final provision requires a personal-data bank created before the Law and its regulations to conform to this Law within the deadline the regulation sets, and requires the bank's owner to declare it to the Autoridad Nacional de Protección de Datos Personales, subject to article 29.

The current implementing regulation is Decreto Supremo No. 016-2024-JUS, published 30 November 2024; its own operative text is not reproduced here, so no specific provision of it beyond its existence and publication date is described here.

Article 11 states the guiding principle that a cross-border transfer of personal data must guarantee a sufficient level of protection for the data to be processed, or, at minimum, a level comparable to what this Law or applicable international standards provide.

Article 15 operationalizes that principle: the titleholder and the processor of a cross-border data flow may carry it out only where the destination country maintains an adequate level of protection under the Law; where it does not, the sender of the transfer must instead guarantee the processing will comply with the Law.

That second requirement does not apply to eight listed cases: a transfer under an international treaty Peru is party to; international judicial cooperation; international cooperation between intelligence agencies against terrorism, drug trafficking, money laundering, corruption, human trafficking, or other organized crime; a transfer necessary to perform a contract the titleholder is party to, including user authentication, service improvement and support, quality monitoring, and account maintenance and billing support; a banking or securities transfer, for the respective transactions and under applicable law; a transfer for the titleholder's medical or surgical prevention, diagnosis, or treatment, or for an epidemiological or similar study using an adequate dissociation procedure; the titleholder's prior, informed, express, and unequivocal consent; and any other case the Law's regulation establishes, subject to article 12.

Article 18 gives the titleholder a right to be informed, in detailed, simple, express, and unequivocal terms before their data is collected, of the processing's purpose, its recipients, the data bank's existence and its owner's identity and address, whether answering is mandatory or optional, any transfer, the retention period, and how to exercise their rights, and lets a controller collecting data online satisfy this through an easily accessible and identifiable privacy policy; it also requires notice to the titleholder of a new processor engaged after consent was given, or of a new data-bank owner following a merger, portfolio acquisition, or similar transfer.

Article 19 gives a right of access to the information processed about oneself, how it was collected, why, at whose request, and what transfers were made or are planned.

Article 20 gives a right to update, include, rectify, or delete personal data that is inaccurate, incomplete, or obsolete, requires the processor to pass the correction on to anyone the data were previously transferred to, and requires the processor to block the data during the update, inclusion, rectification, or deletion process so no third party can access it, with an exception for a public entity that needs the data for its own competencies.

Article 21 gives a right to prevent the data from being supplied to others, especially where that would affect a fundamental right, though it does not reach the internal relationship between a data bank's owner and its processor. Article 22 gives a right to object to processing, absent the titleholder's consent, on well-founded and legitimate grounds tied to a specific personal situation, requiring deletion where the objection is justified.

Article 23 gives a right not to be subject to a decision with legal effects, or that significantly affects the titleholder, based solely on processing meant to evaluate aspects of their personality or conduct, except within a contractual relationship or an evaluation for entry into a public entity, and preserves the right to state one's own view to safeguard a legitimate interest.

Article 24 lets a titleholder whose rights are denied bring a claim to the Autoridad Nacional de Protección de Datos Personales, whose resolution exhausts the administrative channel and opens the door to a contencioso-administrativo action, or pursue a constitutional habeas data action before the Judiciary instead. Article 25 gives a right to compensation for harm the Law's breach causes.

Article 26 sets the fee for exercising these rights before a public-administration data bank by the general administrative-procedure law and leaves a private data bank's fee to special rules.

Article 27 lets a public-administration titleholder or processor deny access, deletion, or objection on grounds tied to protecting a third party's rights, or to avoid obstructing a pending judicial or administrative proceeding on tax, welfare, criminal, health, environmental, or administrative-infraction matters, or where the law otherwise so provides.

Article 32 makes the Ministry of Justice, through its Dirección Nacional de Justicia, the Autoridad Nacional de Protección de Datos Personales, empowers it to open offices nationwide, and gives it sanctioning power under the general administrative-procedure law and coercive power under the coercive-execution law.

Article 33 lists the Authority's functions, including representing Peru internationally on data protection, cooperating with foreign authorities, administering the Registro Nacional de Protección de Datos Personales, publishing the registry of public and private data banks, promoting protection of children's and adolescents' data, issuing technical opinions on draft rules touching personal data that are binding, resolving titleholders' claims and ordering precautionary or corrective measures, and opening investigations on its own initiative or on complaint and applying the corresponding administrative sanctions.

Article 34 creates the Registro Nacional de Protección de Datos Personales to record public and private data banks, cross-border data-flow communications, and the sanctions and precautionary or corrective measures the Authority imposes, open to public consultation as to a bank's existence, purpose, and ownership.

Article 35 binds Authority personnel to confidentiality that survives their tenure, and article 36 funds the Authority from administrative fees, fine proceeds, international technical cooperation, and legacies and donations.

Article 37 lets the sanctioning procedure open on the Authority's own initiative or on a complaint, with its resolutions exhausting the administrative channel and reviewable only through a contencioso-administrativo action; article 38 has the regulation classify infractions as minor, serious, or very serious and lets the Authority order corrective measures alongside a sanction, holding a respondent strictly liable for a breach of personal-data-protection duties.

Article 39 sets three fine tiers, a minor infraction from 0.5 to 5 Tax Units (UIT), a serious infraction from more than 5 to 50 UIT, and a very serious infraction from more than 50 to 100 UIT, with the fine never exceeding ten percent of the offender's gross annual income for the prior fiscal year, without prejudice to any disciplinary, civil, or criminal liability that separately applies; and article 40 lets the Authority impose coercive fines of up to 10 UIT for failing to comply with an accessory obligation the sanctioning procedure imposed.

Disposición complementaria final sexta keeps the constitutional habeas data process, under the Código Procesal Constitucional, independent of the Law's own administrative procedure, and states that the administrative procedure is not a precondition for pursuing the constitutional action, so the Law does not itself arm a titleholder with a private cause of action beyond its own administrative channel and that separate constitutional remedy.

Article 2.5 defines sensitive data as personal data made up of biometric data that by itself can identify the titleholder, data on racial and ethnic origin, income, political, religious, philosophical, or moral opinions or convictions, union affiliation, and information related to health or sex life.

Article 13.6 requires written consent for processing sensitive data, in addition to the general consent requirements article 13.5 states, and permits processing without it only where a law authorizes it and the processing serves important public-interest grounds.

Article 14.6 lets health data be processed without consent where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment, carried out at a health establishment or by a health-sciences professional observing professional secrecy, or where a public-interest or public-health reason the Ministry of Health has qualified as such applies, or for an epidemiological or similar study using an adequate dissociation procedure.

Article 13.3 defers special measures for processing children's and adolescents' personal data to the regulation, and in the meantime requires children and adolescents to exercise the rights the Law grants through their legal representatives, subject to exceptions the regulation may set having regard to the child's or adolescent's best interest.

Article 12-A, incorporated into Ley 30096 by Decreto Legislativo 1700, punishes possessing, buying, receiving, marketing, selling, facilitating, exchanging, or trafficking computer data, access credentials, or personal databases, knowing or having reason to presume they were obtained without the titleholder's consent or through a security breach or the commission of a computer offense, with five to eight years' imprisonment and 180 to 365 day-fines.

The penalty rises to eight to ten years' imprisonment, with disqualification, where the agent acts as a member of a criminal organization, causes serious patrimonial harm or affects a plurality of persons, or the database is processed or held by a public entity.

Decreto Legislativo 1741 widened the article's exemption clause: conduct is exempt from criminal liability where it is carried out with the titleholder's express authorization under Ley 29733, in compliance with a lawful judicial or administrative order, in the legitimate exercise of fundamental rights or legally recognized functions, or as an activity carried out in the securities, financial, pension, or insurance sectors, provided there is no purpose of unlawful gain or improper commercialization of the information. Neither decree states a commencement date for the offense distinct from its own publication.

Article 2 punishes deliberately and illegitimately accessing all or part of a computer system, or exceeding authorized access, with one to four years' imprisonment and thirty to ninety day-fines; the penalty rises to three to six years' imprisonment and eighty to one hundred twenty day-fines where the agent defeats a security measure to gain access.

Article 3 punishes deliberately and illegitimately damaging, introducing, deleting, deteriorating, altering, suppressing, or making inaccessible computer data, and article 4 punishes deliberately and illegitimately disabling a computer system in whole or in part, impeding access to it, or hindering its operation or the provision of its services, each with three to six years' imprisonment and eighty to one hundred twenty day-fines.

Article 7 punishes deliberately and illegitimately intercepting non-public computer data transmissions to, from, or within a computer system. Article 10 punishes fabricating, designing, developing, selling, facilitating, distributing, importing, or obtaining a mechanism, program, device, password, access code, or other computer data specifically designed to commit one of the Law's offenses.

Article 11 raises the sentence by up to one-third above the legal maximum for any of these offenses where an aggravating circumstance applies, including, since Ley 32314 (29 April 2025), where the agent commits the offense using artificial intelligence or a similar or analogous technology. Article 12 exempts from criminal liability conduct described in articles 2, 3, 4, or 10 undertaken to carry out an authorized test or other authorized procedure to protect computer systems.

Article 44 permits quoting from a lawfully disclosed work without the author's consent or payment, provided the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies. The provision is a general quotation exception rather than a text-and-data-mining exception, and Peru has not enacted a distinct exception for automated extraction or analysis of a work's text or data.

This consolidated WIPO Lex text is current to Decreto Legislativo 1391 (2018), whose amendments reach other articles of the statute and not article 44; WIPO Lex flags a further consolidated version as available that is not reproduced here.

Article 5(l) protects an anthology or compilation of works or expressions of folklore, and a database, as a protected work only where the collection is original in the selection, coordination, or arrangement of its contents, so Peru confers no sui generis database right and protects a database only under ordinary copyright's originality standard.

Article 48 permits copying a published sound or audiovisual recording for exclusively personal use, but expressly excludes a database or compilation of data from that personal-use privilege.

Article 44 permits quoting from a lawfully disclosed work without the author's consent or payment, provided the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies.

Article 45(a) permits, without authorization, disseminating images or sounds of a work seen or heard in the course of a current event, by sound or audiovisual means, to the extent an informatory purpose justifies, and article 45(b) permits the press or any transmission medium to disseminate, as news of current events, speeches, lectures, addresses, sermons, and similar works delivered in public, to the extent an informatory purpose justifies and without prejudice to the authors' own right to publish those works individually.

Neither provision carries a headline-length or short-extract cap distinct from this proper-practice and informatory-purpose test, and no reported Peruvian decision applies either provision to a systematic news aggregator rather than an individual quoting or reporting a published work. This consolidated WIPO Lex text is current to Decreto Legislativo 1391 (2018), whose amendments reach other articles of the statute and not articles 44 or 45.