Peru

Regulator And AuthorityGreen

ANPD sits within MINJUSDH and exercises administrative, orienting, normative, resolutive, oversight and sanctioning functions via its Dirección de Protección de Datos Personales and Dirección de Fiscalización e Instrucción.

Claims (1):

• The Autoridad Nacional de Protección de Datos Personales (ANPD) operates two directorates, the Dirección de Protección de Datos Personales and the Dirección de Fiscalización e Instrucción, to enforce Ley N° 29733 and its Reglamento.

Act And InstrumentsGreen

Core instrument is Ley 29733 as amended by DL 1353 (2017); operative secondary instrument is the new Reglamento (DS 016-2024-JUS), replacing DS 003-2013-JUS.

Claims (2):

• Decreto Legislativo N° 1353 (published 7 January 2017) created the current Autoridad Nacional de Transparencia y Acceso a la Información Pública framework and strengthened/reformed the personal-data-protection regime, establishing the ANPD as it exists today.
• The new Reglamento of Ley 29733, approved by Decreto Supremo N° 016-2024-JUS and published 30 November 2024, entered into force on 31 March 2025, repealing the prior 2013 regulation (DS 003-2013-JUS) and introducing new concepts, obligations and rights.

Material ScopeGreen

The regime applies to all personal-data processing, automated or not, by natural persons, public entities or private-sector institutions, regardless of medium.

Claims (1):

• The Reglamento applies to every modality of personal-data processing carried out by natural persons, public entities, or private-sector institutions, irrespective of the medium in which the data are held.

Territorial ScopeGreen

The 2024 Reglamento clarifies extraterritorial reach: it applies to processing carried out in Peru, by an encargado acting for a responsable in Peru regardless of the encargado's location, or by a responsable outside Peru that uses means located in Peru, offers goods/services to persons in Peru, or monitors their behaviour.

Claims (1):

• The Reglamento's Article IV extends application to processing performed in Peruvian territory, by an encargado wherever located acting on behalf of a responsable established in Peru, or by a responsable outside Peru that uses means in Peru, offers goods/services to persons in Peru, or analyses their behaviour.

Regulator Registration And FilingAmber

Controllers (titulares) and processing entities must register the creation, modification or cancellation of 'bancos de datos personales' with the Registro Nacional de Protección de Datos Personales administered by ANPD.

Claims (1):

• Natural or legal persons in the private sector and public entities that create, modify or cancel bancos de datos personales are obligated to process the corresponding inscription before the Registro Nacional de Protección de Datos Personales.

Lawful BasesGreen

Consent is the general lawful basis, subject to enumerated statutory exceptions such as contractual necessity, public-source data, health emergencies and international law-enforcement/intelligence cooperation.

Claims (2):

• Peruvian data-protection law generally requires the free, express, unequivocal, prior and informed consent of the data subject before processing personal data.
• Consent is not required where processing is necessary for performance of a contract to which the data subject is party (including authentication, service support, billing) or for health-emergency prevention, diagnosis or treatment by health professionals bound by professional secrecy.

Consent ThresholdsGreen

Consent must be free, express, unequivocal, prior and informed; special categories require express written consent.

Claims (1):

• Processing of data relating to health or sexual life requires the express, written consent of the data subject, reflecting the heightened threshold applied to sensitive categories.

Special CategoriesGreen

Sensitive data categories include biometric identifiers, racial/ethnic origin, income, political/religious/philosophical/moral opinions, union affiliation, health and sex-life data; the 2024 Reglamento expands this list to include neural data.

Claims (2):

• Sensitive personal data ('datos sensibles') under Peruvian law comprises biometric data capable of identifying the data subject, racial and ethnic origin, income, political, religious, philosophical or moral convictions, union affiliation, and information concerning health or sexual life.
• The 2024 Reglamento expands the definition of sensitive data to explicitly include neural data.

Pseudonymisation And AnonymisationRed

No dedicated statutory pseudonymisation/anonymisation safe-harbour provision was identified in the statute or the 2024 Reglamento within the sources reviewed.

Access RightGreen

Data subjects may request confirmation and details of processing of their data; controllers must respond within 20 business days.

Claims (1):

• Controllers must respond to a data subject's exercise of the right of access within a maximum of 20 business days.

Rectification And ErasureGreen

Rectification and cancellation (erasure) requests must be answered within 10 business days; cancellation is unavailable where data are retained for historical, statistical, scientific, contractual or legal reasons.

Claims (2):

• Requests for rectification, cancellation or opposition must be answered by the controller within 10 business days.
• The cancellation right does not proceed where data are retained for historical, statistical or scientific reasons, where necessary for a contractual relationship, or where required to be processed by law.

Restriction And ObjectionGreen

Data subjects may oppose processing on justified, legitimate grounds relating to their particular situation where consent was not required; the controller must then cease the challenged processing if the opposition is well-founded.

Claims (1):

• A data subject may oppose processing of their data, absent prior consent, where founded and legitimate reasons relating to their concrete personal situation exist; if the opposition is justified, the controller or processor must act on it.

Data PortabilityGreen

The 2024 Reglamento introduces a portability right allowing data subjects to receive their data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, when processing is based on consent, contract, or automated means.

Claims (1):

• Article 76 of the 2024 Reglamento creates a portability right permitting data subjects to receive their personal data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, where processing is consent-based, contractual, or automated, provided this is not excessively onerous and is technically feasible.

Deadlines And Response WindowsGreen

Response deadlines (20 business days for access; 10 business days for rectification/cancellation/opposition) run from the day after submission and may be extended once for an equal period if circumstances justify it.

Claims (1):

• ARCO response deadlines may be extended once, for an equal period, when circumstances justify the extension, with the decision and justification communicated to the data subject within the original deadline.

Accountability And DpiaRed

No explicit DPIA-trigger regime was identified in the sources reviewed; accountability is expressed generally through the security and documentation duties in the 2024 Reglamento.

Dpo RequirementsGreen

A designated 'Oficial de Datos Personales' is mandatory for public entities and for private entities that process large volumes of data, sensitive data, data affecting a large number of people, or whose principal activities involve sensitive data.

Claims (1):

• The 2024 Reglamento (Art. 37) requires designation of an Oficial de Datos Personales where processing is carried out by a public entity, involves large volumes of data or sensitive data or data affecting a large number of persons, or where the responsible party's principal activities involve sensitive data.

Ropa RequirementsAmber

Peru does not operate a GDPR-style internal ROPA obligation as such; instead, controllers must register/inscribe each banco de datos personales in the Registro Nacional, which performs an analogous transparency function.

Claims (1):

• Controllers must register the creation, modification and cancellation of each banco de datos personales with the Registro Nacional de Protección de Datos Personales, providing its denomination, location, purposes and uses, functioning as the principal processing-inventory mechanism in lieu of a discrete ROPA obligation.

Joint Controller ArrangementsRed

No detailed joint-controller regime distinct from the general titular/encargado (controller/processor) framework was identified in the sources reviewed.

Security MeasuresGreen

Controllers must adopt technical, organisational and legal measures to secure personal data and prevent unauthorised alteration, loss, processing or access; the 2024 Reglamento adds documented, dated security-policy and access-control requirements.

Claims (2):

• Controllers must adopt technical, organisational and legal measures guaranteeing the security of personal data and preventing its alteration, loss, unauthorised processing or access; processing in databases lacking such conditions is prohibited.
• The 2024 Reglamento adds obligations to maintain a documented, dated security policy (Art. 47) and to implement access controls to secure areas (Art. 49) and equipment (Art. 50) inside and outside the controller's premises.

Breach NotificationGreen

Controllers must notify ANPD, and generally the affected data subject, within 48 hours of becoming aware of a security incident, even if already remediated, unless the incident caused no impact and was fully resolved.

Claims (1):

• Article 34 of the 2024 Reglamento requires the controller to notify ANPD, at most within 48 hours of becoming aware of a security incident, and to notify the affected data subject within the same period in clear language, unless the incident caused no harm and was fully resolved internally.

Retention And DisposalRed

No general statutory retention-period ceiling or disposal-schedule requirement was located in the sources reviewed; retention limits appear tied case-by-case to purpose limitation and consent duration.

Transfer MechanismsGreen

Transfers are acceptable where the receiving country has an adequate protection level as evaluated by ANPD, or under agreements with common and general protection standards; otherwise the exporter must use model contractual clauses or equivalent instruments.

Claims (1):

• Cross-border transfer of personal data from Peru is acceptable if the receiving country has an adequate protection level as evaluated by the competent authority, or if agreements exist establishing common and general protection standards; failing that, the exporter must guarantee adequate treatment via model contractual clauses or other legal instruments reflecting equivalent obligations, such as a code of conduct.

Adequacy ReceivedRed

No evidence was found in the sources reviewed that Peru has been granted an adequacy decision by the European Commission or another comparable third-country regime.

Claims (1):

• No source reviewed indicates that Peru has been the subject of a European Commission adequacy decision under Article 45 GDPR; recent EU adequacy activity identified in the review period concerned Brazil, not Peru.

Adequacy GrantedRed

No published ANPD list of countries formally recognised as offering an adequate level of protection was located; ANPD appears to assess adequacy case-by-case rather than via a standing list.

Sccs And BcrsGreen

ANPD approved an Implementation Guide for Model Contractual Clauses for international data transfer in 2023, based on the Red Iberoamericana de Protección de Datos (RIPD) model clauses.

Claims (1):

• ANPD approved a 'Guía de Implementación de Cláusulas Contractuales Modelo para la Transferencia Internacional de Datos Personales', based on the model published by the Red Iberoamericana de Protección de Datos (RIPD), to support compliant cross-border transfers.

Transfer Impact AssessmentAmber

No standalone, GDPR-style transfer-impact-assessment obligation distinct from the general 'burden of proof rests with the exporter' rule was identified in the sources reviewed.

Claims (1):

• Under the Reglamento, the burden of proving that a cross-border transfer complied with the Law and Reglamento rests, in every case, on the exporter of the data (emisor), functioning as a de facto documentation obligation rather than a formal transfer-impact-assessment procedure.

Data LocalisationRed

No general data-localisation mandate (partial or absolute) was identified in the statute or the 2024 Reglamento within the sources reviewed.

Financial Sector OverlayAmber

Ley 27489 regulates CEPIRS credit-bureau data sharing; SBS holds prudential competence and INDECOPI exercises complementary consumer-protection jurisdiction over credit reporting, while ANPD separately sanctions financial entities for unlawful personal-data collection/use, including biometric data misuse.

Claims (2):

• Ley N° 27489 regulates the supply of credit-risk information in the market by Centrales Privadas de Información de Riesgos (CEPIRS), promoting veracity, confidentiality and appropriate use of such information while protecting the rights of data subjects.
• ANPD sanctioned Alfin Banco S.A. with fines of 139.32 UIT (approximately S/669,000) for unlawfully using personal data obtained from a private risk-information central without demonstrating the lawful origin of the collection.

Health Sector OverlayGreen

Ley 26842 and Ley 30024 protect the confidentiality of clinical/health records, guarantee patient access to their historia clínica, and designate MINSA as titular of the national electronic clinical-history database, operating alongside Ley 29733's sensitive-data rules for health information.

Claims (2):

• Ley N° 26842 (Ley General de Salud) guarantees the patient's right to reserve/confidentiality of their historia clínica, subject only to statutory exceptions, and obliges health establishments to provide the patient or their legal representative a copy of the clinical history on request.
• Ley N° 30024 creates the Registro Nacional de Historias Clínicas Electrónicas, granting patients or their legal representatives unrestricted access to their clinical information and designating the Ministerio de Salud as titular of the national database.

Telecoms And EprivacyAmber

The 2024 Reglamento permits a single call to solicit consent for commercial prospecting; INDECOPI provides consumer guidance distinguishing lawful consented contact from unlawful 'spam' calls.

Claims (1):

• Under Article 26 of the 2024 Reglamento, companies may make a single call to request the citizen's consent for advertising/commercial-prospecting purposes, provided the contact data were obtained from a lawful source.

Employment DataRed

No dedicated employment-sector data-protection overlay distinct from the general LPDP regime was identified in the sources reviewed.

Credit And ScoringAmber

Credit-scoring data flows through CEPIRS are governed by Ley 27489, with the Tribunal Constitucional confirming that credit-history dissemination for risk purposes does not require the data subject's consent given its constitutionally legitimate market function, and 2025-2026 legislative activity requiring financial entities and risk centrals to update credit information promptly.

Claims (1):

• The Tribunal Constitucional has held that CEPIRS dissemination of credit-history data serves a constitutionally legitimate market function and therefore does not require the data subject's consent, while remaining limited to credit-related data.

EducationAmber

No dedicated education-sector data-protection overlay was identified in the sources reviewed beyond a documented ANPD sanction against an educational entity for using illicitly sourced criminal-background data.

Claims (1):

• ANPD sanctioned a consultancy firm and a higher-education entity for a very serious infraction consisting of collecting personal data (criminal/police background) through fraudulent, disloyal or unlawful means, carrying fines from 50 to 100 UIT.

InsuranceRed

No dedicated insurance-sector data-protection overlay distinct from the general LPDP regime was identified in the sources reviewed.

Cookies And TrackersRed

No dedicated cookie/tracker-consent regime distinct from the general LPDP consent framework was identified in the sources reviewed.

Dark PatternsRed

No explicit statutory dark-pattern prohibition was identified in the sources reviewed.

Opt Out SignalsRed

No recognition of technical opt-out signals (e.g. Global Privacy Control, DAA AdChoices) was identified in the sources reviewed.

Clean Rooms And DcrRed

No clean-room or data-collaboration-room-specific rules were identified in the sources reviewed.

Cross Context AdvertisingRed

No CPRA-style 'sale'/'share' cross-context-advertising concept was identified; Peru's regime instead relies on the general consent/lawful-basis framework for any onward disclosure.

Direct MarketingGreen

Commercial prospecting/marketing processing requires direct consent obtained at first contact; using illicitly sourced data for such contact, or contacting without consent, are separately graded infractions.

Claims (2):

• Processing personal data for commercial prospecting/advertising purposes is only permitted if the data subject has given direct consent at first contact, and the controller must be able to inform the data subject, on request, of the source from which the data were collected.
• Under the 2024 Reglamento, using data of illicit origin for marketing purposes is sanctioned with fines ranging from 50 to 100 UIT, while processing data for commercial prospecting without requesting prior consent is sanctioned with a fine ranging from 5 to 50 UIT.

Profiling RestrictionsAmber

No Article-22-style dedicated profiling restriction distinct from the general opposition right and sensitive-data consent rules was identified in the sources reviewed.

Automated Decision Making TransparencyRed

No dedicated automated-decision-making transparency/explanation right distinct from the general access right was identified in the sources reviewed.

Ai Risk AssessmentsRed

Peru has no standalone AI-risk-assessment statute; the 2024 Reglamento's explanatory materials reference AI and profiling as drivers for regulatory modernisation, but no discrete AI-risk-assessment obligation was located.

Claims (1):

• MINJUSDH's stated rationale for the new draft Reglamento explicitly cited the need to address challenges posed by digital technologies, e-commerce, artificial intelligence and personal-data profiling, though the resulting text does not create a discrete AI-specific risk-assessment procedure.

Biometric RegimeGreen

Biometric data capable of identifying the data subject is classified as sensitive data requiring express consent and enhanced security measures; ANPD has actively enforced against unauthorised fingerprint collection/storage by financial institutions.

Claims (2):

• Biometric data that by itself can identify the data subject is classified as sensitive personal data under Peruvian law, requiring express consent and enhanced security safeguards.
• In January 2026, ANPD fined Banco de Crédito del Perú (24.75 UIT plus 4.89 UIT), ALFIN Banco (66 UIT plus 13.50 UIT) and BanBif (7.5 UIT), totalling up to S/577,368, for collecting, storing and using fingerprint biometric data without adequate consent, disclosure or security measures.

Genetic DataAmber

No genetic-data-specific regime distinct from the general sensitive-data category was identified in the sources reviewed.

State Surveillance CarveoutsAmber

Cross-border data flows for international intelligence cooperation against terrorism, drug trafficking, money laundering, corruption, human trafficking and other organised crime are exempted from the standard adequacy/consent transfer conditions.

Claims (1):

• Cross-border data flows undertaken for international intelligence-agency cooperation to combat terrorism, illicit drug trafficking, money laundering, corruption, human trafficking and other forms of organised crime are exempted from the ordinary cross-border transfer conditions.

Age VerificationAmber

For online consent-taking, controllers must make reasonable efforts, given available technology, to verify the identity of the person granting consent.

Claims (1):

• For internet-based processing of minors' data, controllers must make reasonable efforts, taking into account available technology, to verify the identity of the person granting consent.

Parental ConsentGreen

Processing of a minor's data generally requires the consent of those holding patria potestad or guardianship; minors aged 14-17 may consent directly if information is provided in comprehensible language.

Claims (2):

• Processing of a minor's personal data generally requires the consent of the holders of patria potestad or tutela, as applicable.
• Minors older than 14 and younger than 18 may consent directly to processing of their personal data provided the information was expressed in language comprehensible to them, subject to statutory exceptions.

Minor Profiling BansGreen

Minor self-consent is never valid for goods or services subject to age restrictions, and collecting data revealing a minor's family-group circumstances without parental consent is prohibited.

Claims (2):

• In no case is a minor's own consent valid for the processing of data relating to goods or services that are age-restricted.
• It is prohibited to collect personal data of minors that reveals information about their family group without the consent of the holders of patria potestad or tutela.

Education SettingsRed

No education-setting-specific data-protection sub-regime distinct from the general LPDP framework and the isolated ANPD enforcement action against an educational entity (noted under sectoral_watch) was identified in the sources reviewed.

Dependent AdultsRed

No dependent-adult-specific (elderly, mentally incapacitated) data-protection sub-regime was identified in the sources reviewed.

Regulator Powers And PenaltiesGreen

ANPD exercises administrative, oversight and sanctioning functions and can classify infractions as leve, grave or muy grave, with fines from 0.5 UIT up to 100 UIT depending on gravity, plus coercive fines up to 10 UIT.

Claims (3):

• Infractions under Ley 29733 and its Reglamento are classified as leve, grave or muy grave, each carrying escalating fines.
• Leve infractions carry a minimum fine of 0.5 UIT up to 5 UIT.
• ANPD may impose coercive fines of up to 10 UIT for non-compliance with accessory obligations imposed in a sanctioning procedure, in addition to the principal fine.

Enforcement Activity IndexGreen

Enforcement activity has been visible and escalating, including the 2025 Alfin Banco sanction and the January 2026 multi-bank biometric-data sanctions.

Claims (2):

• ANPD imposed fines totalling 139.32 UIT (approximately S/669,000) on Alfin Banco S.A. for unlawfully using personal data obtained from a private risk-information central, confirmed on appeal in one instance.
• In January 2026, ANPD imposed combined fines of up to S/577,368 on Banco de Crédito del Perú, ALFIN Banco and BanBif for unlawful collection, storage and use of biometric fingerprint data.

Regulator Funding And CapacityAmber

Historical ANPD activity data (e.g. 128 sanctioning procedures initiated and 2,808 data banks registered in a prior reporting period) indicate an operationally active but resource-constrained regulator; no current staffing/budget figures were located.

Claims (1):

• In a prior annual reporting period, ANPD initiated 128 sanctioning procedures, delivered informational talks to more than 10,000 people, and registered 2,808 personal-data banks.

Collective Redress And Class ActionsRed

No dedicated class-action or collective-redress mechanism specific to data-protection claims was identified in the sources reviewed; the trilateral ARCO procedure before ANPD functions as an individual, not collective, remedy.

Private Right Of ActionGreen

Data subjects harmed by non-compliance with the Law have a statutory right to obtain indemnification, in accordance with general civil-liability law, independent of any administrative sanction.

Claims (1):

• A data subject affected by a controller's, processor's or third party's non-compliance with Ley 29733 has the right to obtain corresponding indemnification in accordance with law.

Recent Developments 180DAmber

Within the review window, ANPD published its 2018-2025 management-balance bulletin (late January 2026) and posted further institutional news (23 February 2026); the January 2026 biometric-data sanctions against major banks, while falling just outside a strict 180-day look-back from the 7 August 2026 run date, represent the most recent substantive enforcement action identified and are included here as the closest available recent-developments signal.

Claims (1):

• ANPD published a '2018-2025 Management Balance' institutional bulletin in late January 2026 and posted additional institutional news on 23 February 2026, reflecting continued regulatory activity within the recent-developments window.