I. Non-territorial application

The Law and the Regulations will apply to database owners or data controllers who are not located in Peru but who carry out the following activities:

• Activities related to the offer of goods or services directed to personal data subjects located in Peru
• Activities intended for the analysis of behavior of personal data owners located in Peru, as well as the elaboration of profiles that seek to predetermine behaviors, preferences, habits or similar information

II. Designation of a processing representative in Peru

Database owners or data controllers, whether or not located in Peru, must designate a representative in Peru to be the point of contact with the National Authority for the Protection of Personal Data ("Authority") through the following:

• Publicly publishing it in a privacy policy
• Communicating it to the Authority

III. Additional information for the owner of the personal data

In addition to the information set forth in Article 18 of the Law, for the purpose of processing personal data, the respective owner must be informed of the following:

• Whether their data will be subject to automated decisions, including profiling
• The source of collection of their personal data in case it has not been obtained directly from the holder

IV. Processing of personal data of children and adolescents

The database owner or data controller in digital platforms or services must make reasonable efforts to verify the identity of those who give consent, to comply with the obligations regarding processing the data of minors.

V. Processing of personal data for advertising purposes

• Consent for advertising purposes may be obtained during the first contact with the personal data subject.
• The personal data subject must be informed of the source of collection of their information upon request.

VI. Notification of security incidents

• A security incident is any breach of security that results in the destruction, loss or unlawful alteration of personal data or unauthorized communication or exposure to such data.
• The security incident must be notified to the Authority within 48 hours of becoming aware of it.
• The affected personal data owner must be notified of the security incident within 48 hours of becoming aware that it may affect their rights.
• Any security incident must be documented, including the related facts, effects and measures taken.

VII. Designation of a personal data officer

The database owner or data controller and processor of personal data must designate a personal data compliance officer if they carry out the following activities:

• Processing large volumes of personal data in quantity or type of data; processing data that may affect a large number of individuals; when dealing with sensitive data; or when there is an evident prejudice to other rights or freedoms of the holder of the personal data
• Main activities or business activities that involve the processing of sensitive data

The database owner or data controller and data processor of personal data must publish the contact details of the personal data officer in a visible place. This information must also be communicated to the Authority.

A corporate group may appoint a single personal data compliance officer.

VIII. New security measures

Those responsible for processing personal data have the following obligations:

• Prepare an inventory of personal data and systems used for processing, specifying whether sensitive data is involved
• Make backup copies at least once a week, unless the personal data has not been updated during that period

IX. Right to portability of personal data

The owner of the personal data may request that the personal data they provided to the data controller or to the database owner be transferred to another party, when the processing is based on consent or on a contractual relationship or is carried out by automated means.

X. Mitigating factors of liability

Under certain circumstances, the following may be considered as mitigating factors in an administrative sanctioning procedure:

• The implementation of codes of conduct
• The implementation of an impact assessment report on the processing of personal data

The Regulations will become effective on 30 March 2025. The obligations regarding the designation of the personal data compliance officer will become effective subsequently as of 30 November 2025, based on annual sales.

You can find the full text of the Regulations here.

*****

We hope this information is of relevance to you and your company. Please do not hesitate to contact us if you require any advice in this regard.

Click here to access the Spanish version.

* * * * *

© 2024 Estudio Echecopar. All rights reserved. Estudio Echecopar is a member firm of Baker & McKenzie International, a Swiss Verein with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "partner" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.