Peru. Comprehensive data protection. Law
Law 29733Personal Data Protection Law, Law No. 29733 (Ley de Protección de Datos Personales)
In force
§1Summary
- Synopsis
Peru's comprehensive data protection law requiring consent (with exceptions), registration of databases, security and transfer safeguards, and providing ARCO rights enforced by a national authority in the Ministry of Justice.
- Key themes
- Unique features
Mandatory registration of personal data banks and of international transfers with the authority.
- SaaS relevance
The 2025 Regulation extends to foreign controllers/processors offering goods or services to or monitoring people in Peru.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ANPD within 48h for significant incidents; affected individuals
- DPO
- Conditional
- Cross-border transfers
- Adequacy or safeguards; notify transfers to authority
- Maximum penalty
- Up to 100 UIT (approx. PEN 550,000)
§3Dates
- Key dates
- Adopted
- In force
- Amended by Legislative Decree 1353 (2017); new Regulation DS 016-2024-JUS in force 2025-03-30
§4Text and authority
- Text
- Authoritative text gob.pe
- Authority
- Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights
§5Where it applies
- Domestic law of
- Peru
§6Sources and verification
- Verification
High confidence.
Text URL guessed from gob.pe pattern.