Peru Data Protection Update 2026: The Personal Data Officer Deadline for Mid-Sized Companies

The new Regulation of Peru's Personal Data Protection Law (Law No. 29733), approved by Supreme Decree No. 016-2024-JUS, introduced obligations step by step. The next milestone is close: from 30 November 2026, mid-sized companies that fall under the relevant criteria must have a Personal Data Officer (Oficial de Datos Personales) in place.

Background

The Regulation was published in the official gazette El Peruano on 30 November 2024 and entered into force 120 calendar days later, replacing the 2013 Regulation (Supreme Decree No. 003-2013-JUS). Some obligations apply in stages that are counted from the publication date.

Who Must Appoint a Personal Data Officer?

Under Article 37, controllers and processors must appoint a Personal Data Officer when:

1. the processing is carried out by a public entity;
2. they process large volumes of personal data, data that may affect a large number of people, or sensitive data, or the processing causes evident harm to other rights of the data subject; or
3. their core business activities involve processing sensitive data.

A corporate group may appoint a single officer, provided that it is easy to contact from each establishment. For cases 2 and 3, the obligation applies in stages based on annual sales:

• More than 2,300 UIT: from 30 November 2025 (already in force)
• Medium-sized companies, more than 1,700 and up to 2,300 UIT: from 30 November 2026
• Small companies, more than 150 and up to 1,700 UIT: from 30 November 2027
• Micro-enterprises, up to 150 UIT: from 30 November 2028

Failing to appoint the officer when required is listed as an infringement in the Regulation. The officer can be an employee or an external provider, as long as they have the necessary knowledge and can act independently. An outsourced DPO is a common option for companies that do not need a full-time role.

48-Hour Breach Notification

Article 34 requires the controller to notify the National Authority for Personal Data Protection (ANPDP) within 48 hours of becoming aware of a security incident that exposes large volumes of data, may affect a large number of people, involves sensitive data or causes evident harm. Key points:

• A later notification must explain the reasons for the delay
• The duty applies even if the incident has already been resolved internally
• The notification must describe the incident, the contact person, the likely consequences and the measures taken
• Every incident must be documented, including those that did not need to be notified (Article 35)
• Processors must inform the controller immediately (Article 36)

Other Changes Worth Knowing

• Data portability (Article 76) has applied since six months after the Regulation entered into force
• Data protection impact assessments are voluntary under Article 40, but recommended for sensitive data, profiling and vulnerable groups
• "Yo cuido mis datos personales" is a new digital platform where individuals can complain to the ANPDP if their rights requests are not answered

What to Do Before 30 November 2026

1. Check your size band and whether your processing meets the criteria in Article 37
2. Appoint the Personal Data Officer and publish their contact details
3. Prepare your breach procedure and a notification template so you can meet the 48-hour deadline
4. Review your data banks and their registration with the national register
5. Train your staff to recognise and report incidents immediately

Our free DPO Guide for Peru walks internal data protection staff through 13 practical workshops, from the applicable laws to audits.

This article provides general information as of 20 October 2026 and does not constitute legal advice. Source: Supreme Decree No. 016-2024-JUS, published in El Peruano on 30 November 2024.