Peru
SubstantialPersonal Data Protection Law No. 29733
Authority: National Authority for Personal Data Protection (ANPD) | Enforcement: Active | Enacted: May 2013
Overview
Peru enacted its Personal Data Protection Law in 2011, with regulations in 2013. The ANPD within the Ministry of Justice oversees compliance and enforces the law. The framework covers consent, data subject rights, and cross-border transfers.
14-Topic Coverage
Data Protection Authority
Fully AddressedANPD oversees compliance, maintains the national registry, and enforces the law.
Consent Requirements
Fully AddressedFree, prior, express, informed, and unequivocal consent required.
Data Subject Rights
Fully AddressedRights to access, rectification, cancellation, opposition, and information.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with consent.
Breach Notification
Partially AddressedNo explicit statutory requirement. ANPD guidance developing.
DPO Requirements
Partially AddressedMust register databases with ANPD. No formal DPO role required.
Children's Data
Partially AddressedParental consent required for children. General provisions apply.
Penalties & Enforcement
Fully AddressedFines from 0.5 to 100 UIT (approx. PEN 495,000). Active enforcement.
Sector-Specific Rules
Fully AddressedSBS financial data rules, health data regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Fully AddressedLaw applies to both public and private sector databases.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Peru's regulations.
Book a Consultation