Peru Personal Data Protection Law — Law No. 29733

Why does it matter?

Law No. 29733 is the only general data protection statute in Peru, and the ANPD enforces it with inspection, sanctioning and coercive powers under the Administrative Procedure Act, Law 27444 (Art. 32). Every data bank, public or private, has to be registered and the register is public (Art. 34), so an organization's processing is visible to the authority and to the people whose data it holds. Since March 30, 2025 the 2024 Regulation has raised the bar on incidents, officers and foreign providers.

Key benefits include:

• A register the public can search

Any person can consult the Registro Nacional de Protección de Datos Personales to learn which data banks exist, their purposes and who is responsible for them (Art. 34), which makes an unregistered bank easy to detect.

• Consent that holds up

Consent must be previous, informed, express and unequivocal, and written for datos sensibles (Art. 13.5 and 13.6); the burden of proving it sits with the titular del banco de datos (Regulation Art. 9).

• Defined response clocks

The Regulation fixes 8 days for information requests, 20 days for access and 10 days for rectification, cancellation or opposition (Art. 69), and 48 hours for notifying qualifying security incidents to the ANPD (Art. 34).

• Fines scaled to the infraction

Leve infractions carry 0.5 to 5 UIT, grave more than 5 to 50 UIT and muy grave more than 50 to 100 UIT, capped at 10 percent of the previous year's gross income (Law Art. 39).

• Reach beyond Peru

The Regulation applies to a titular del banco de datos outside Peru that offers goods or services to people in Peru or analyzes their behavior, and requires a representative as the ANPD's point of contact (Arts. VI and VII).

How does it work?

Processing rests on consent unless Art. 14 provides otherwise: no consent is needed for public functions, publicly accessible sources, credit-solvency data under the law, data needed to perform a contract with the titular, health data in a medical setting, anonymized or disassociated data and legitimate interests of the titular de datos personales (Art. 14.1 to 14.10). Before collection the titular must be told the purpose, recipients, the data bank and its owner, whether answers are mandatory, transfers, consequences of refusing, retention time and how to exercise rights (Art. 18); online, a privacy policy can carry that notice.

Every titular del banco de datos personales registers the creation, modification or cancellation of its data banks with the Registro Nacional (Regulation Arts. 42 to 45); registration is free and automatically approved (Art. 43.3 and 45.2). Security follows Law Art. 16 and Regulation Arts. 46 to 58: digital systems need documented access control with at least semiannual privilege reviews, traceability logs kept for two years, and a formally approved Documento de Seguridad with a personal data inventory (Arts. 46 and 47), which may follow NTP-ISO/IEC 27001.

A flujo transfronterizo may go to a country with an adequate level of protection declared by the Dirección General, or under guarantees such as model contractual clauses, and must be reported for inscription in the Registro Nacional (Regulation Arts. 18 to 21). A security incident that exposes large volumes of data, many people or datos sensibles is notified to the ANPD within 48 hours and, where other rights are affected, to the titulares (Art. 34); every incident is documented (Art. 35) and an encargado reports immediately to the owner of the data bank (Art. 36).

Key Elements

• Definitions (Law Art. 2; Regulation Art. III)

Seventeen statutory terms including banco de datos personales, datos sensibles (biometric, racial or ethnic origin, income, political, religious or philosophical opinions, union membership, health and sexual life), encargado, flujo transfronterizo, titular de datos personales and titular del banco de datos; the Regulation adds responsable del tratamiento, Oficial de Datos Personales, incidente de seguridad and elaboración de perfiles.

• Guiding principles (Arts. 4 to 12)

Legality, consent, purpose, proportionality, quality, security, availability of recourse and adequate level of protection; Art. 12 makes the list non-exhaustive and an interpretive yardstick for the law and its Regulation.

• Processing rules (Arts. 13 to 17)

Consent that is previous, informed, express and unequivocal, written for datos sensibles and revocable at any time (Art. 13); the ten exceptions in Art. 14; transfers only to countries with adequate protection or under the exporter's guarantees (Art. 15); security measures set by the ANPD (Art. 16) and a confidentiality duty that survives the relationship (Art. 17).

• Rights of the titular (Arts. 18 to 27)

Information, access, updating, inclusion, rectification and suppression, preventing supply, opposition, objective treatment (no decision based solely on automated profiling) and tutela before the ANPD or a hábeas data action (Art. 24); the Regulation adds portability as a form of access (Art. 76).

• Data banks and processors (Arts. 28 to 31)

The obligations list in Art. 28, creation and cancellation of data banks (Art. 29), service providers that may not reuse or transfer data and must delete it when the contract ends (Art. 30) and voluntary codes of conduct (Art. 31).

• The ANPD and the Registro Nacional (Arts. 32 to 36)

Twenty-one functions in Art. 33, from administering the register and supervising cross-border flows to resolving reclamaciones and opening inspections; the register records data banks, authorizations, sanctions and codes of conduct (Art. 34).

• Oficial de Datos Personales (Regulation Arts. 37 to 39)

Mandatory for public entities, for organizations processing large volumes or datos sensibles and for those whose core business involves sensitive data; contact details are published and sent to the ANPD within 15 days; the officer advises, verifies compliance and is the ANPD's point of contact.

• Infractions and sanctions (Arts. 37 to 40; Regulation Arts. 131 to 135)

Leve, grave and muy grave infractions, the UIT fine bands and the 10 percent income cap (Art. 39), coercive fines up to 10 UIT (Art. 40), and the Regulation's lists, which make failing to notify an incident or to appoint an Oficial de Datos Personales sanctionable.

What does it cover?

Law No. 29733 applies to personal data contained in, or destined for, bancos de datos personales of public or private administration whose processing takes place in Peru, with special protection for datos sensibles (Art. 3). It does not apply to data banks created by natural persons for their private or family life, or to public data banks used strictly for legal competences, national defense, public security or criminal investigation (Art. 3.1 and 3.2). The Regulation extends coverage to processing outside a data bank (Art. IV) and to establishments in Peru, encargados acting for them wherever located, and foreign controllers that target or profile people in Peru (Art. VI).

What are its objectives?

The law states its purpose in Art. 1 and its principles in Title I; read together they set these outcomes:

Guarantee the fundamental right to protection of personal data recognized in Article 2.6 of the Constitution, within respect for the other fundamental rights (Art. 1).

Make processing lawful, consented, purpose-bound, proportionate and accurate, and keep data only as long as the purpose requires (Arts. 4 to 8).

Secure data with technical, organizational and legal measures suited to the category of data (Art. 9 and Art. 16), and keep it confidential (Art. 17).

Give every titular administrative and judicial routes to enforce their rights, including the reclamación before the ANPD and hábeas data (Arts. 10 and 24).

Allow international transfers only where the destination offers a sufficient level of protection or the exporter guarantees it (Arts. 11 and 15).

Keep the existence, purpose and ownership of every data bank public through the Registro Nacional (Arts. 29 and 34).

Framework in Context

The law rests on Article 2.6 of the Peruvian Constitution and borrows its procedure from Law 27444, the Administrative Procedure Act, for sanctions, reclamaciones and coercive fines (Arts. 24, 32, 37 and 40). The 2024 Regulation ties it to digital government: incidents in the digital environment are also reported to the Centro Nacional de Seguridad Digital under Decreto de Urgencia 007-2020 (Regulation Art. 34.5), public entities designate their officer under the Ley de Gobierno Digital rules (Art. 37.1), and the Documento de Seguridad and impact assessments may follow NTP-ISO/IEC 27001, 27005 and NTP-ISO 31000 (Arts. 40.2 and 47.1). It is not a GDPR transposition: it keeps its own actors and its register-based model. Credit-bureau consumer complaints stay with Indecopi (Seventh Final Provision).

Common Framework Mappings

Organizations that operate in several countries map Law No. 29733 and its Regulation to the privacy laws and privacy management standards below, so one set of records of data banks, consents, transfers and incidents can serve more than one regime.

Mapped frameworks include:

APEC PF

Argentina PDPL (Law 25.326)

LGPD

CCPA/CPRA

GDPR

ISO 27701

LFPDPPP

NIST Privacy Framework v1.0