Peru. Comprehensive data protection. Decree
DS 016-2024-JUSSupreme Decree No. 016-2024-JUS approving the new Regulation of Law 29733
In force
§1Summary
- Synopsis
Replaces the 2013 regulation with GDPR-style rules: extraterritorial scope, 48-hour breach notification, mandatory DPOs for certain organisations, privacy by design, portability and specific rules on minors and digital services.
- Key themes
- Unique features
DPO obligation phased by company revenue size through 2028; digital incidents also reported to the National Digital Security Centre.
- SaaS relevance
Foreign SaaS providers targeting Peru come into scope and must manage 48h breach reporting and possible DPO appointment.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ANPD within 48h (significant incidents); data subjects within 48h where rights affected
- DPO
- Conditional
- Maximum penalty
- Fines graded minor/severe/very severe up to PEN 550,000
§3Dates
- Key dates
- Adopted
- In force
- DPO deadlines by company size: large 2025-11-30; medium 2026-11-30; small 2027-11-30; micro 2028-11-30; Directive 100-2025-JUS-DGTAIPD on DPOs (2025-12-31)
§4Text and authority
- Text
- Authoritative text gob.pe
- Authority
- Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights
§5Where it applies
- Domestic law of
- Peru
§6Sources and verification
- Verification
High confidence.