Countries › Peru › Guide › 13. Regulation › Personal data protection in Peru: who is covered, database registration, cross border transfers, 48 hour breach notice, data protection officers and fines

Personal data protection in Peru: who is covered, database registration, cross border transfers, 48 hour breach notice, data protection officers and fines

Last verified: 2026-10-28 · Status: Changing

Peru's data law (Ley Nº 29733) and its 2024 regulation, in force since 30 March 2025, apply to processing in Peru and to foreign companies that offer goods or services to people in Peru or profile them, so a foreign app or online store can be covered without a local entity. Databases must be registered (free of charge), transfers abroad need an adequate country or contractual safeguards and must be reported, serious breaches go to the authority within 48 hours, and access requests get an answer within 20 days. A data protection officer becomes mandatory in stages by company size; for medium companies (above 1,700 UIT of sales) the date is 30 November 2026. Fines reach 100 UIT (S/ 550,000), capped at 10 percent of prior year gross income.

USD figures use S/ 3.452 per US dollar, the banking system selling rate published by the Superintendencia de Banca, Seguros y AFP for 27 October 2026, from the Banco Central de Reserva del Perú statistics series PD04640PD. UIT based amounts use the 2026 UIT of S/ 5,500 set by Decreto Supremo Nº 301-2025-EF, as listed in the SUNAT UIT table. Fines expressed in UIT are paid at the UIT in force on the payment date. Conversions are for orientation only.

Key facts

Ley Nº 29733 Reglamento (DS Nº 016-2024-JUS) in force	2025-03-30 dateDS Nº 016-2024-JUS First Final Complementary Provision (120 calendar days after 30 November 2024), as of 2026-10-28 · in force
Applies to foreign controllers targeting or profiling people in Peru	Yes DS Nº 016-2024-JUS art. VI 3.1 and 3.2, as of 2026-10-28 · in force
Data protection authority	Autoridad Nacional de Protección de Datos Personales (Ministry of Justice and Human Rights) Ley Nº 29733; DS Nº 016-2024-JUS, as of 2026-10-28 · in force
Breach notice to the authority	48 hoursDS Nº 016-2024-JUS art. 34.1, as of 2026-10-28 · in force
Response time for an access request	20 daysDS Nº 016-2024-JUS art. 69.2, as of 2026-10-28 · in force
Data protection officer mandatory (phased by company size from 30 November 2025 to 30 November 2028)	Yes DS Nº 016-2024-JUS art. 37 and First Final Complementary Provision, as of 2026-10-28 · in force
Registration of personal databases required	Yes, free DS Nº 016-2024-JUS art. 42 and 43.3, as of 2026-10-28 · in force
Maximum data protection fine	100 UITLey Nº 29733 art. 39, as of 2026-10-28 · in force
Data protection fine cap, share of prior year gross income	10 %Ley Nº 29733 art. 39, as of 2026-10-28 · in force

The rule

1. The law and regulation apply when data is processed in an establishment in Peru of the database owner or controller; when a processor anywhere processes on behalf of a controller established in Peru; and when a controller not established in Peru uses means located in Peru, which expressly includes offering goods or services to data subjects in Peru and analysing their behaviour or building profiles of people in Peru.
Cost to do it: Compliance costs: privacy notices, records of databases and processing, contracts with processors.
Example: A Colombian fintech app with no Peruvian entity that onboards users in Lima and scores their behaviour is covered under art. VI 3.1 and 3.2. / Same for a US online retailer targeting Peruvian shoppers.Reglamento de la Ley Nº 29733, approved by Decreto Supremo Nº 016-2024-JUS (El Peruano, 30 November 2024), Art. VI num. 1 to 3, 2024-11-30 official text · verified 2026-10-28

2. Anyone in the private sector who creates, modifies or cancels a personal database must register those acts in the Registro Nacional de Protección de Datos Personales, which also records sanctions and corrective measures. Registration, modification and cancellation are free. Registrations must be kept up to date at all times.
Cost to do it: Free registration; internal time to inventory databases.
Example: A company opening in Lima with an employee database, a customer database and a CCTV database registers each one free of charge. / No government fee in dollars; the cost is staff or adviser time.Reglamento DS Nº 016-2024-JUS, Art. 42, art. 43 and art. 44, 2024-11-30 official text · verified 2026-10-28

3. Transfers require the data subject's consent, save legal exceptions, limited to the purpose that justifies them, and must be disclosed to the data subject; the recipient becomes bound by the law. Cross border flows should go to countries with an adequate level of protection, declared by the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales; otherwise the exporter must provide safeguards such as model contractual clauses that impose at least the same obligations. Every cross border flow must be reported to that Directorate for registration, and the exporter may ask its opinion on a transfer, to be issued within 30 days.
Cost to do it: Contract drafting for intra group and vendor transfers; no fee stated in the Reglamento.
Example: A Peruvian subsidiary hosting HR data on its US parent's cloud must sign transfer clauses with the importer and notify the flow to the Directorate for registration. / Same for any SaaS vendor outside Peru processing Peruvian customer data.Reglamento DS Nº 016-2024-JUS, Art. 12, art. 13, art. 18, art. 19, art. 20 and art. 21, 2024-11-30 official text · verified 2026-10-28

4. When a security incident exposes large volumes of data, may affect many people, involves sensitive data or causes evident harm to other rights, the controller must notify the Autoridad Nacional de Protección de Datos Personales within 48 hours of becoming aware, explaining any delay; the duty remains even if the incident was resolved internally. The notice describes the incident, data and people affected, a contact point, likely consequences and remedial measures. Affected data subjects must also be told within 48 hours in plain language, unless the incident caused no harm and was fully contained. All incidents must be documented.
Cost to do it: Incident response plan and forensic support; late notice must be justified.
Example: A ransomware attack on a clinic's patient records detected at 10:00 on a Friday must be notified to the authority and the patients by 10:00 on Sunday. / Peru's 48 hour window is shorter than the 72 hours many foreign groups use in their global playbooks.Reglamento DS Nº 016-2024-JUS, Art. 34.1 to 34.4 and art. 35, 2024-11-30 official text · verified 2026-10-28

5. A data protection officer is mandatory for public entities, for controllers or processors that handle large volumes of data, data that may affect many people, sensitive data, or data whose processing causes evident harm, and for those whose core business involves processing sensitive data. A group can appoint one officer if easily reachable from each establishment. The officer's contact details must be published and reported to the authority within 15 days of appointment. For private companies the duty phases in by annual sales from the regulation's publication on 30 November 2024: above 2,300 UIT after one year, medium companies above 1,700 and up to 2,300 UIT after two years, small companies above 150 and up to 1,700 UIT after three years, and microenterprises up to 150 UIT after four years. Data portability applies six months after the regulation entered into force.
Cost to do it: Salary or outsourced officer cost; no filing fee for the 15 day notice.
Example: A logistics company with annual sales of 2,000 UIT (S/ 11,000,000) that processes customer data at scale must have its officer in place by 30 November 2026. / Thresholds at the 2026 UIT: 2,300 UIT is S/ 12,650,000 (US$3.66 million); 1,700 UIT is S/ 9,350,000 (US$2.71 million); 150 UIT is S/ 825,000 (US$238,992).Reglamento DS Nº 016-2024-JUS, Art. 37.1 to 37.5 and First Final Complementary Provision, 2024-11-30 official text · verified 2026-10-28

6. Data subjects can exercise information, access, rectification, cancellation, objection and portability rights through a simple procedure set by the controller. The maximum response time is 8 days for the right to information, 20 days for access and 10 days for rectification, cancellation or objection, counted from the day after the request. A refusal must be reasoned and tell the data subject they can complain to the Dirección de Protección de Datos Personales or bring a habeas data action.
Cost to do it: Internal process and staff time.
Example: An access request received on 2 November 2026 must be answered within 20 days counted from 3 November. / A global DSAR process set to 30 days would breach Peru's shorter deadlines.Reglamento DS Nº 016-2024-JUS, Art. 67, art. 69, art. 73 and art. 76, 2024-11-30 official text · verified 2026-10-28

7. Minor infringements are fined from 0.5 UIT up to 5 UIT, serious ones from more than 5 up to 50 UIT and very serious ones from more than 50 up to 100 UIT. A fine can never exceed 10 percent of the offender's gross income in the previous year, which the company must prove with tax returns or financial statements. Since Decreto Legislativo Nº 1353 (El Peruano, 7 January 2017) rewrote art. 38, infringements are typified in the regulation, and controllers and processors are strictly liable for breaching data protection rules; that decree did not amend the fine scale in art. 39. The authority can also impose coercive fines of up to 10 UIT to enforce its orders.
Cost to do it: Up to S/ 550,000 per very serious infringement, within 10 percent of gross income.
Example: A company with S/ 3 million of gross income fined for a very serious infringement is capped at 10 percent, S/ 300,000, below the 100 UIT maximum of S/ 550,000. / About US$86,906 under the income cap versus US$159,328 at the maximum.Ley Nº 29733, Ley de Protección de Datos Personales (El Peruano, 3 July 2011), art. 38 as amended by Decreto Legislativo Nº 1353; Reglamento DS Nº 016-2024-JUS, Art. 38, art. 39 and art. 40 of the law; art. 124 of the Reglamento, 2011-07-03 official text · verified 2026-10-28

Company size by annual sales	Officer mandatory from	S/ threshold at 2026 UIT
Above 2,300 UIT	30 November 2025	Above S/ 12,650,000
Medium: above 1,700 up to 2,300 UIT	30 November 2026	S/ 9,350,000 to S/ 12,650,000
Small: above 150 up to 1,700 UIT	30 November 2027	S/ 825,000 to S/ 9,350,000
Micro: up to 150 UIT	30 November 2028	Up to S/ 825,000

Phase in of the data protection officer duty for private companies within art. 37.1 num. 2 and 3, counted from publication of DS Nº 016-2024-JUS on 30 November 2024.

Category	Fine range	S/ at 2026 UIT
Minor	0.5 to 5 UIT	S/ 2,750 to S/ 27,500
Serious	Above 5 to 50 UIT	Up to S/ 275,000
Very serious	Above 50 to 100 UIT	Up to S/ 550,000

Fines under Ley Nº 29733 art. 39, each capped at 10 percent of prior year gross income.

Worked example

A Spanish e-commerce group sells to Peruvian consumers from Madrid and stores their data in Ireland. It is covered under art. VI, must register its customer database, use transfer safeguards and report the flow, answer access requests within 20 days and notify a significant breach within 48 hours. If it has a Peruvian subsidiary with sales of 2,000 UIT that processes data at scale, that subsidiary needs a data protection officer from 30 November 2026. A very serious breach could cost up to 100 UIT, S/ 550,000 (about US$159,328).

Step by step

Map Peruvian personal data: databases, purposes, legal bases, transfers and processors.
Register each database in the national registry (free) and keep entries updated.
Sign transfer clauses for every cross border flow and report the flows for registration.
Adopt a 48 hour breach procedure for the authority and data subjects, and an incident log.
Appoint and notify a data protection officer within 15 days if required, checking the size based date that applies.
Set data subject request workflows for the 8, 10 and 20 day deadlines.

Common traps

Foreign controllers that target or profile people in Peru are covered without a Peruvian entity.
Breach notice is 48 hours, not 72.
The officer phase in date for medium companies is 30 November 2026.
Registration of databases is mandatory even though it is free.
The 10 percent of income cap depends on the company proving its income.
Liability is strict under art. 38 as amended by DL Nº 1353: lack of intent is no defence.

Sources

← Consumer protection in Peru: information duties, complaints book, 15 day response, e-commerce rules for foreign sellers and INDECOPI finesBribery and corruption offences in Peru: public and foreign bribery, influence peddling, collusion in procurement and private sector corruption →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.