Peru

Article 22 classifies AI risk into two named categories, uso indebido (misuse, deemed prohibited by definition) and high-risk use, and treats every other use as acceptable risk. Article 23 deems it misuse to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter behavior.

It is also misuse to generate an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting. Carrying out mass surveillance without a legal basis or where it generates or may generate a disproportionate impact on the exercise of fundamental rights is misuse as well.

So is analyzing, classifying, or inferring a person's sensitive data from their biometric data to deduce racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation, or evaluating or classifying natural persons or groups in a way that produces discriminatory or disproportionate results violating fundamental rights.

Carrying out real-time biometric identification to categorize natural persons in public spaces is misuse too, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes. Predicting that a natural person will commit a crime based on profiling or an assessment of personality traits is likewise misuse.

Article 23.4 excepts, specifically from the real-time biometric identification prohibition, a system that supports a human evaluator's assessment of a person's involvement in an existing criminal activity, provided the assessment rests on objective, verifiable facts and the system carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination.

The Regulation applies to public-administration entities and to private-sector organizations, civil society, citizens, and academia, and enters into force ninety business days after its publication. It creates no sanctioning regime of its own for a breach of these prohibitions distinct from referring suspected violations to the competent authority.

Article 24 classifies an AI-based system's use as high-risk where, among other criteria, it manages critical national assets supporting essential services (energy, telecommunications, health, transport, water, and banking, among others) or is used to evaluate a person in a selection process. A developer or implementer may ask the SGTD to determine whether a use falls within the high-risk category.

Article 25 requires the developer or implementer of a high-risk system to establish mechanisms guaranteeing algorithmic transparency, informing the user beforehand, clearly and simply, of the system's purpose or use, its main functions, and the kind of decisions it can make, and, where the system's decisions affect human rights, to explain its results to affected users in accessible language.

For a private-sector developer or implementer, article 25's transparency duty and a related Title VI chapter phase in gradually by sector, starting the day after the Decreto Supremo's publication: one year for AI uses in health, education, justice, security, and economy-finance; two years for transport, commerce, and labor; three years for production, agriculture, energy, and mining; and four years for every other use nationwide, with a further, longer schedule for small businesses and innovative start-ups.

Public-sector entities implement article 25 on their own graduated schedule, running from one to three years after the Decreto Supremo's publication depending on the type of entity; only for the smallest local governments (Tipo D, E, F, and G) is implementing article 25 described as facultative, according to their resources and capacities.

Article 26 requires compliance with the personal-data and privacy rules in force for any high-risk system's development, implementation, or use, and states that liability for a breach of those data-protection duties is determined under Ley No. 29733's own sanctioning regime rather than under this Decreto Supremo.

Article 34 requires the holder of a personal-data bank or the controller to notify the Autoridad Nacional de Protección de Datos Personales within 48 hours of becoming aware of a security incident that exposes large volumes of personal data, may affect a large number of people, involves sensitive data or clearly harms other rights of the data subject.

Article 34 also requires the same party to tell the data subject within 48 hours, without undue delay and in plain language, of a security incident that affects the data subject's other rights. Article 35 requires the controller to document any security incident, including the related facts, its effects and the measures adopted. Article 36 requires a processor to inform the data bank holder or controller immediately of a security incident it learns of.

Article 46 requires the platforms, websites, mobile applications, digital services and information systems used to process personal data to generate and keep records of interactions with the data, including the user accounts with access, session start and end times and the actions of processing, viewing, modification, deletion, import and export. Those interaction records must be kept for a minimum period of two years.

Article 1 states the Law's object as guaranteeing the constitutional right to personal-data protection, and article 3 applies it to personal data contained or destined to be contained in a personal-data bank of public or private administration whose processing takes place within Peru, excluding a bank a natural person creates for purposes exclusively related to their private or family life and, within the limits it states, a public-administration bank's processing that is strictly necessary for the competencies the law assigns the entity, national defense, public security, or criminal investigation and prosecution.

Articles 4 through 10 and 12 state the Law's guiding principles: legality (no collection by fraudulent, unfair, or unlawful means), consent, purpose limitation, proportionality, quality (data must be truthful, accurate, and kept only as long as the purpose requires), security, and a right of recourse, and article 12 makes the principles interpretive criteria for the whole Law and its regulation.

Article 13 requires the titleholder's prior, informed, express, and unequivocal consent for ordinary processing, revocable at any time under the same requirements as its grant, and article 14 lists the cases where consent is not required, including processing by a public entity within its own competencies, data from publicly accessible sources, and processing necessary to perform a contract the titleholder is party to.

Article 16 requires the data bank's owner to adopt technical, organizational, and legal measures that guarantee security and prevent unauthorized alteration, loss, processing, or access, and bars processing in a data bank that does not meet the Authority's security requirements, while article 17 binds the data bank's owner, its processor, and anyone else who takes part in the processing to confidentiality that survives the end of their relationship with the owner.

Article 28 lists the titleholder's and processor's general obligations, echoing the consent, purpose-limitation, and deletion duties, and requiring cooperation with the Authority's information requests in a pending administrative proceeding.

Article 29 conditions a personal-data bank's creation, modification, or cancellation on the regulation and guarantees public access to its existence, purpose, and ownership; article 30 requires a processor handling data under a service contract to use it only for the contracted purpose, not transfer it further, and delete it once the contract is performed, absent authorization to retain it against a likely further engagement; and article 31 lets private-sector representative bodies adopt conduct codes for their members.

The Law's fifth complementary final provision requires a personal-data bank created before the Law and its regulations to conform to this Law within the deadline the regulation sets, and requires the bank's owner to declare it to the Autoridad Nacional de Protección de Datos Personales, subject to article 29.

The current implementing regulation is Decreto Supremo No. 016-2024-JUS, published 30 November 2024; its own operative text is not reproduced here, so no specific provision of it beyond its existence and publication date is described here.

Article 2 of the Regulation makes consent to the processing of personal data valid only when it is free, prior, express and unequivocal, and informed. Article 3.2 treats conditioning a service, or threatening to deny access to benefits or services that are normally unrestricted, as affecting the freedom of consent where the data requested are not indispensable to the service.

Article 7 states that publishing a privacy policy complies with the duty of information and the transparency principle but does not remove the requirement to obtain the data subject's consent. Article 9 places the burden of proving consent, in every case, on the holder of the personal-data bank or the controller.

Article 10.4 requires the holder of the personal-data bank or the controller to provide mechanisms that are easily accessible, unconditional, simple, quick and free to make a revocation of consent effective.

Article 37.1 requires a data bank holder, controller or processor to designate a Personal Data Officer where a public entity carries out the processing, where the processing involves large volumes of personal data, sensitive data or evident harm to other rights of the data subject, or where the party's main business activities involve processing sensitive data.

Article 37.5 requires the contact details of the designated officer, and any update, to be communicated to the Autoridad Nacional de Protección de Datos Personales within 15 days. The first final complementary provision phases in the officer duty in the cases of Article 37.1, points 2 and 3, by annual sales, from one year after publication of the Regulation for companies with sales above 2,300 UIT to four years after publication for micro-enterprises with sales up to 150 UIT.

Article 42.1 requires private-sector persons and public entities that create, modify or cancel personal-data banks to process the registration of those acts with the Registro Nacional de Protección de Datos Personales. The first final complementary provision brings the Regulation into force 120 calendar days after its publication in the official gazette El Peruano.

Article 11 states the guiding principle that a cross-border transfer of personal data must guarantee a sufficient level of protection for the data to be processed, or, at minimum, a level comparable to what this Law or applicable international standards provide.

Article 15 operationalizes that principle: the titleholder and the processor of a cross-border data flow may carry it out only where the destination country maintains an adequate level of protection under the Law; where it does not, the sender of the transfer must instead guarantee the processing will comply with the Law.

That second requirement does not apply to eight listed cases: a transfer under an international treaty Peru is party to; international judicial cooperation; international cooperation between intelligence agencies against terrorism, drug trafficking, money laundering, corruption, human trafficking, or other organized crime; a transfer necessary to perform a contract the titleholder is party to, including user authentication, service improvement and support, quality monitoring, and account maintenance and billing support; a banking or securities transfer, for the respective transactions and under applicable law; a transfer for the titleholder's medical or surgical prevention, diagnosis, or treatment, or for an epidemiological or similar study using an adequate dissociation procedure; the titleholder's prior, informed, express, and unequivocal consent; and any other case the Law's regulation establishes, subject to article 12.

Article 18.1 of the Regulation requires a cross-border flow of personal data to be made when the receiver or importer is in a country with an adequate level of data protection under the Law and the Regulation. Article 18.2 requires the sender or exporter, where the country lacks an adequate level of protection, to give adequate guarantees for the processing outside Peru, except in the cases of Article 15 of the Law.

Article 19.1 has the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales issue a resolution determining whether a country has protection equivalent to the Law and the Regulation. Article 20.1 lets the exporter rely on model contractual clauses, or other legal instruments imposing at least the same obligations as the exporter's own and the conditions under which the data subject consented, as the guarantee.

Article 21.1 lets a data bank holder or controller ask the Dirección General for an opinion on whether its cross-border flow complies, to be issued within 30 days. Article 21.2 requires every cross-border flow of personal data to be brought to the attention of the Dirección General, with the information required for the transfer and for the data bank registration, and has the communication entered in the Registro Nacional de Protección de Datos Personales.

Article 23 gives a right not to be subject to a decision with legal effects, or that significantly affects the titleholder, based solely on processing meant to evaluate aspects of their personality or conduct, except within a contractual relationship or an evaluation for entry into a public entity, and preserves the right to state one's own view to safeguard a legitimate interest.

Article 18 gives the titleholder a right to be informed, in detailed, simple, express, and unequivocal terms before their data is collected, of the processing's purpose, its recipients, the data bank's existence and its owner's identity and address, whether answering is mandatory or optional, any transfer, the retention period, and how to exercise their rights, and lets a controller collecting data online satisfy this through an easily accessible and identifiable privacy policy; it also requires notice to the titleholder of a new processor engaged after consent was given, or of a new data-bank owner following a merger, portfolio acquisition, or similar transfer.

Article 19 gives a right of access to the information processed about oneself, how it was collected, why, at whose request, and what transfers were made or are planned.

Article 20 gives a right to update, include, rectify, or delete personal data that is inaccurate, incomplete, or obsolete, requires the processor to pass the correction on to anyone the data were previously transferred to, and requires the processor to block the data during the update, inclusion, rectification, or deletion process so no third party can access it, with an exception for a public entity that needs the data for its own competencies.

Article 21 gives a right to prevent the data from being supplied to others, especially where that would affect a fundamental right, though it does not reach the internal relationship between a data bank's owner and its processor. Article 22 gives a right to object to processing, absent the titleholder's consent, on well-founded and legitimate grounds tied to a specific personal situation, requiring deletion where the objection is justified.

Article 24 lets a titleholder whose rights are denied bring a claim to the Autoridad Nacional de Protección de Datos Personales, whose resolution exhausts the administrative channel and opens the door to a contencioso-administrativo action, or pursue a constitutional habeas data action before the Judiciary instead. Article 25 gives a right to compensation for harm the Law's breach causes.

Article 26 sets the fee for exercising these rights before a public-administration data bank by the general administrative-procedure law and leaves a private data bank's fee to special rules.

Article 27 lets a public-administration titleholder or processor deny access, deletion, or objection on grounds tied to protecting a third party's rights, or to avoid obstructing a pending judicial or administrative proceeding on tax, welfare, criminal, health, environmental, or administrative-infraction matters, or where the law otherwise so provides.

Article 69 sets the maximum time to answer a rights request at 8 days for the right of information, 20 days for access, and 10 days for rectification, cancellation and opposition, counted from the day after the request is filed. Article 71 lets the time to answer a request other than one for information be extended once, by an equal period at most, where circumstances justify it, and requires the justification to be communicated to the data subject within the period being extended.

Article 68.4 makes the data bank holder or controller responsible for proving that it met the duty to respond, and requires it to keep the means of doing so. Article 73 requires a total or partial refusal of a rights request to be duly justified and to tell the data subject that a claim may be brought before the Dirección de Protección de Datos Personales or a habeas data action before the Judiciary.

Article 75.1 gives the data subject the right to be told, clearly and in simple language, which personal data are processed, how and why they were collected, at whose request, and what transfers were made or are planned. Article 76.1 gives the data subject a right to portability, to obtain the personal data the person supplied in a structured, commonly used, machine-readable format and have them transmitted to another controller, where processing rests on consent or a contract or is automated.

The first final complementary provision makes the portability right of Article 76 take effect 6 months after the Regulation enters into force. Article 82.3 makes the filing of an erasure request imply that processing of the data stops, through blocking, while later deletion is assessed. Article 83 requires the controller to document to the data subject that an erasure request was met and to identify to whom the deleted data had been transferred.

Article 86.4 lets the data subject object at any time to processing for advertising and commercial prospecting, including profiling, unless a prior contractual relationship supports the processing. Article 87.2 requires the controller to inform the data subject, as soon as possible, when personal data are processed as part of a decision-making process without the data subject's participation.

Article 32 makes the Ministry of Justice, through its Dirección Nacional de Justicia, the Autoridad Nacional de Protección de Datos Personales, empowers it to open offices nationwide, and gives it sanctioning power under the general administrative-procedure law and coercive power under the coercive-execution law.

Article 33 lists the Authority's functions, including representing Peru internationally on data protection, cooperating with foreign authorities, administering the Registro Nacional de Protección de Datos Personales, publishing the registry of public and private data banks, promoting protection of children's and adolescents' data, issuing technical opinions on draft rules touching personal data that are binding, resolving titleholders' claims and ordering precautionary or corrective measures, and opening investigations on its own initiative or on complaint and applying the corresponding administrative sanctions.

Article 34 creates the Registro Nacional de Protección de Datos Personales to record public and private data banks, cross-border data-flow communications, and the sanctions and precautionary or corrective measures the Authority imposes, open to public consultation as to a bank's existence, purpose, and ownership.

Article 35 binds Authority personnel to confidentiality that survives their tenure, and article 36 funds the Authority from administrative fees, fine proceeds, international technical cooperation, and legacies and donations.

Article 37 lets the sanctioning procedure open on the Authority's own initiative or on a complaint, with its resolutions exhausting the administrative channel and reviewable only through a contencioso-administrativo action; article 38 has the regulation classify infractions as minor, serious, or very serious and lets the Authority order corrective measures alongside a sanction, holding a respondent strictly liable for a breach of personal-data-protection duties.

Article 39 sets three fine tiers, a minor infraction from 0.5 to 5 Tax Units (UIT), a serious infraction from more than 5 to 50 UIT, and a very serious infraction from more than 50 to 100 UIT, with the fine never exceeding ten percent of the offender's gross annual income for the prior fiscal year, without prejudice to any disciplinary, civil, or criminal liability that separately applies; and article 40 lets the Authority impose coercive fines of up to 10 UIT for failing to comply with an accessory obligation the sanctioning procedure imposed.

Disposición complementaria final sexta keeps the constitutional habeas data process, under the Código Procesal Constitucional, independent of the Law's own administrative procedure, and states that the administrative procedure is not a precondition for pursuing the constitutional action, so the Law does not itself arm a titleholder with a private cause of action beyond its own administrative channel and that separate constitutional remedy.

Article 121.1 lets the Dirección de Protección de Datos Personales, once a sanctioning procedure has begun and at the request of the Dirección de Fiscalización e Instrucción, order provisional measures that secure the effect of the final decision.

Article 122.2 lets the Dirección de Protección de Datos Personales order corrective measures, including ceasing processing of data obtained disproportionately or without consent, deleting data obtained without consent, and immediately attending the right the data subject requested. Article 124.1 lets a respondent prove, in its reply to the charges, the gross annual income it received in the year before the infraction, in the manner the second paragraph of Article 39 of the Law provides.

Article 129 has the Registro Nacional de Protección de Datos Personales record those sanctioned under the Law and the Regulation, and the precautionary and corrective measures, and has them published on the digital site of the Ministry of Justice and Human Rights.

Article 130.1 has the Dirección de Protección de Datos Personales impose coercive fines automatically, without prior demand, for failure to comply with corrective and precautionary measures, up to 2 UIT for minor, 2 to 6 UIT for serious and 6 to 10 UIT for very serious infractions. Article 130.2 lets a new coercive fine be imposed where the failure persists, doubling the last fine successively up to 100 UIT.

Article 132 makes failing to communicate a cross-border flow to the Dirección de Protección de Datos Personales for registration, and failing to designate a Personal Data Officer where required, minor infractions. Article 133 makes processing personal data without the free, express, unequivocal, prior and informed consent of the data subject, where required, a serious infraction.

Article 133 makes unjustifiably refusing to give the Autoridad Nacional de Protección de Datos Personales the information or documents on processing that it requests in an inspection or pending proceeding a serious infraction. Article 133 makes failing to notify the Autoridad Nacional de Protección de Datos Personales of a personal-data security incident, where Article 34 of the Regulation requires it, a serious infraction. Article 134 makes processing personal data by fraudulent, unfair or unlawful means a very serious infraction.

Article 2.5 defines sensitive data as personal data made up of biometric data that by itself can identify the titleholder, data on racial and ethnic origin, income, political, religious, philosophical, or moral opinions or convictions, union affiliation, and information related to health or sex life.

Article 13.6 requires written consent for processing sensitive data, in addition to the general consent requirements article 13.5 states, and permits processing without it only where a law authorizes it and the processing serves important public-interest grounds.

Article 14.6 lets health data be processed without consent where necessary, in a risk situation, for the titleholder's medical or surgical prevention, diagnosis, or treatment, carried out at a health establishment or by a health-sciences professional observing professional secrecy, or where a public-interest or public-health reason the Ministry of Health has qualified as such applies, or for an epidemiological or similar study using an adequate dissociation procedure.

Article 13.3 defers special measures for processing children's and adolescents' personal data to the regulation, and in the meantime requires children and adolescents to exercise the rights the Law grants through their legal representatives, subject to exceptions the regulation may set having regard to the child's or adolescent's best interest.

Article 8 of the Regulation requires consent to the processing of sensitive data, besides meeting the requirements of valid consent, to be given in writing by handwritten, digital or electronic signature or another form that guarantees the data subject's will.

Article 22.1 and 22.2 make processing of the data of children and adolescents lawful when the consent of those holding parental authority or guardianship is obtained, and let a person over fourteen and under eighteen consent according to capacity where the information is given in language the person understands.

Article 22.3 bars consent to the processing of a child's or adolescent's data from being given so that the child can access activities linked to goods or services restricted for the child's age. Article 23.1 bars collecting a child's or adolescent's data that reveal information about other members of the family group, such as the parents' occupation or economic information, without those persons' consent.

Articles 25.2 and 25.3 make processing in digital services offered to persons over fourteen and under eighteen lawful with their own consent, and processing in digital services aimed at children under fourteen lawful with the consent of those holding parental authority or guardianship.

Article 25.4 requires the holder or controller on digital platforms and services to make reasonable efforts, taking available technology into account, to verify the identity of those who give consent in those cases.

Article 12-A, incorporated into Ley 30096 by Decreto Legislativo 1700, punishes possessing, buying, receiving, marketing, selling, facilitating, exchanging, or trafficking computer data, access credentials, or personal databases, knowing or having reason to presume they were obtained without the titleholder's consent or through a security breach or the commission of a computer offense, with five to eight years' imprisonment and 180 to 365 day-fines.

The penalty rises to eight to ten years' imprisonment, with disqualification, where the agent acts as a member of a criminal organization, causes serious patrimonial harm or affects a plurality of persons, or the database is processed or held by a public entity.

Decreto Legislativo 1700 as published exempts from criminal liability conduct carried out with the titleholder's express authorization under Ley 29733, in compliance with a lawful judicial or administrative order, or in the legitimate exercise of fundamental rights or legally recognized functions, provided there is no purpose of unlawful gain or improper commercialization of the information.

Decreto Legislativo 1741 widened that clause to cover activities carried out in the securities, financial, pension, or insurance sectors. The provisions this entry describes came into force on different days.

Article 2 punishes deliberately and illegitimately accessing all or part of a computer system, or exceeding authorized access, with one to four years' imprisonment and thirty to ninety day-fines; the penalty rises to three to six years' imprisonment and eighty to one hundred twenty day-fines where the agent defeats a security measure to gain access.

Article 3 punishes deliberately and illegitimately damaging, introducing, deleting, deteriorating, altering, suppressing, or making inaccessible computer data, and article 4 punishes deliberately and illegitimately disabling a computer system in whole or in part, impeding access to it, or hindering its operation or the provision of its services, each with three to six years' imprisonment and eighty to one hundred twenty day-fines.

Article 7 punishes deliberately and illegitimately intercepting non-public computer data transmissions to, from, or within a computer system. Article 10 punishes fabricating, designing, developing, selling, facilitating, distributing, importing, or obtaining a mechanism, program, device, password, access code, or other computer data specifically designed to commit one of the Law's offenses.

Article 11 raises the sentence by up to one-third above the legal maximum for any of these offenses where an aggravating circumstance applies, including, since Ley 32314 (29 April 2025), where the agent commits the offense using artificial intelligence or a similar or analogous technology. Article 12 exempts from criminal liability conduct described in articles 2, 3, 4, or 10 undertaken to carry out an authorized test or other authorized procedure to protect computer systems.

Article 44 permits quoting from a lawfully disclosed work without the author's consent or payment, provided the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies. Article 44 is a general quotation exception that names no text-and-data-mining purpose, and the text of the Law does not mention text and data mining. This text is the consolidation current to Decreto Legislativo 1724 of 7 February 2026.

Article 5(l) protects an anthology or compilation of works or expressions of folklore, and a database, as a protected work only where the collection is original in the selection, coordination, or arrangement of its contents, so Peru confers no sui generis database right and protects a database only under ordinary copyright's originality standard.

Article 48 permits copying a published sound or audiovisual recording for exclusively personal use, but expressly excludes a database or compilation of data from that personal-use privilege.

Article 14.1 of the Regulation requires digital service providers in the financial, basic-service, health, passenger-transport, internet-service, critical-activity and education sectors to manage digital-security risks in their organization so as to set controls that protect the confidentiality, integrity and availability of information.

Article 18.1(b) of the Regulation requires such a provider to implement security controls and measures in providing its digital services according to its risk assessment. Article 18.1(f) of the Regulation requires such a provider to maintain a secure, scalable and interoperable infrastructure. Article 18.1(i) of the Regulation requires such a provider to test its digital services proactively for vulnerabilities.

Where a provider is also regulated by a law or special rule, article 18.2 of the Regulation requires it to comply with its sector rules, and the Regulation then applies only in what those rules do not provide. A private organization outside the scope of Decreto de Urgencia 007-2020 treats the Regulation as reference only. Article 15 of the Regulation leaves it to a private entity whether to designate a digital security and trust officer.

Supreme Decree 126-2025-PCM was published in the official gazette El Peruano on 4 November 2025. The Regulation enters into force ninety calendar days after the day following its publication.

Article 1.1 of the Regulation applies it to the companies named in articles 16 and 17 of the General Law of the Financial System and to the private pension fund administrators. Article 4.2 of the Regulation makes its general regime mandatory for banks and financial companies among others.

The general regime also covers pension fund administrators, card issuers, electronic-money issuers and Banco de la Nación. Article 5 of the Regulation makes the board responsible for approving and facilitating the actions required to have an appropriate information-security and cybersecurity management system.

Article 6.1 of the Regulation makes the general management of a covered company responsible for taking the measures needed to implement its information-security and cybersecurity management system. Article 4.1 of the Regulation requires the system to be proportionate to the size, nature and complexity of the company operations.

Article 16.1 of the Regulation requires a company to make the arrangements needed to hold information that lets it act in time against cybersecurity threats and to treat vulnerabilities. The Superintendencia issued the Resolution under the powers conferred by numerals 7 and 9 of article 349 of Law 26702. The Resolution is dated 19 February 2021. The Resolution was published in the official gazette El Peruano on 23 February 2021. The Resolution enters into force on 1 July 2021, the date on which Circular G 140-2009 is repealed.

Article 18.1(a) of the Regulation requires such a provider to notify the Centro Nacional de Seguridad Digital (CNSD) of the digital-security incidents of its organization through the established protocols, channels and deadlines. Article 32.1 of the Regulation requires a critical-level incident to be notified to the CNSD within a maximum of forty-eight hours from when the provider becomes aware of it.

Article 32.2 of the Regulation requires an incident of any other classification to be notified within the periods the Secretaría de Gobierno y Transformación Digital sets. Article 31.2 of the Regulation requires the notification to contain at least a description of the incident, its classification and its impact.

Article 34.4 of the Regulation makes the provider responsible for notifying the CNSD of an incident, with its third-party service providers reporting to the provider the incidents under their control. Notifying the CNSD does not release the provider from notifying the Autoridad Nacional de Protección de Datos Personales where the incident compromised the personal data of its users. Supreme Decree 126-2025-PCM was published in the official gazette El Peruano on 4 November 2025. The Regulation enters into force ninety calendar days after the day following its publication.

Article 15.1 of the Regulation requires a company to report to the Superintendencia, as soon as it becomes aware of it, a cybersecurity incident with a verified or presumed significant adverse impact. Article 15.2 of the Regulation requires the company to carry out a forensic analysis to determine the causes of the incident and take measures to manage it.

Article 15.3 of the Regulation lets the Superintendencia set the minimum content, format and additional protocols of the report by a general rule. Article 1.1 of the Regulation applies it to the companies named in articles 16 and 17 of the General Law of the Financial System and to the private pension fund administrators. The Superintendencia issued the Resolution under the powers conferred by numerals 7 and 9 of article 349 of Law 26702. The Resolution is dated 19 February 2021.

The Resolution was published in the official gazette El Peruano on 23 February 2021. The Resolution enters into force on 1 July 2021, the date on which Circular G 140-2009 is repealed.

Article 44 permits quoting from a lawfully disclosed work without the author's consent or payment, provided the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies.

Article 45(a) permits, without authorization, disseminating images or sounds of a work seen or heard in the course of a current event, by sound or audiovisual means, to the extent an informatory purpose justifies, and article 45(b) permits the press or any transmission medium to disseminate, as news of current events, speeches, lectures, addresses, sermons, and similar works delivered in public, to the extent an informatory purpose justifies and without prejudice to the authors' own right to publish those works individually.

Article 45 applies in each case only if the author's name and the source are stated and the reproduction or disclosure has not been expressly reserved. Neither provision carries a headline-length or short-extract cap distinct from this proper-practice and informatory-purpose test, and no reported Peruvian decision applies either provision to a systematic news aggregator rather than an individual quoting or reporting a published work. This text is the consolidation current to Decreto Legislativo 1724 of 7 February 2026.