Your Jurisdiction at a Glance — Peru

Law 29733 on Personal Data Protection and its Regulation (Supreme Decree 016-2024-JUS)

Authority: National Authority for Personal Data Protection (ANPDP), Ministry of Justice and Human Rights

Requirements to remember

Peru
  • Data breach notification to the ANPDP within 48 hours (Art. 34 of the Regulation)
  • Personal Data Officer (Oficial de Datos Personales), phased in by company size from 30 November 2025 (Art. 37 of the Regulation)
  • Registration of personal data banks with the National Registry for Personal Data Protection
  • ARCO rights plus data portability

Where the programme covers them

  • Task 2 of this workshop: document Peru in the data protection scope document, together with sector rules and other countries you operate in
  • Workshop 2: governance, roles and the data protection officer
  • Workshop 3: records of processing activities
  • Workshop 8 and 9: risk assessment and security measures
  • Workshop 10: vendors, processors and international transfers
  • Workshop 11: data breaches and notification deadlines
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Peru Slide 9 of 10