Law: Law No. 29.733 on the Protection of Personal Data 2011 (only available in Spanish here) and Regulation of Law No. 29733 (only available in Spanish here).

Regulator: National Authority for the Protection of Personal Data (ANPD)

Summary: Law No. 29733 on the Protection of Personal Data 2011 (the Law) was published on July 3, 2011, and Supreme Decree No. 003-2013-JUS which Approves the Regulation of Law No. 29733 (the Regulation) was enacted on March 22, 2013. The Law provides for various data subject rights, such as the right to access and rectify data, object to processing, and to be informed of any processing. Moreover, the Law requires data controllers to register all personal databases in the National Registry of Personal Data Protection managed by the National Authority for the Protection of Personal Data (ANPD), as well as to notify the ANPD of any cross-border data transfers.

On November 30, 2024, Supreme Decree No. 016-2024-JUS, approving the Regulation of Law No. 29733 (only available in Spanish here) (the new Regulation) was published and will enter into effect 120 days following its publication. The new Regulation provides for specific conditions for the processing of minors' data, the obligation of controllers to notify data breaches to the ANPD, the obligation to designate a data protection officer (DPO) in certain cases, specific criteria for calculating sanctions, and the criteria for determining if a third country has an adequate level of compliance for international data transfers.