Peru

Article VI of the Regulation approved by Supreme Decree 016-2024-JUS extends the regime to controllers not established in Peru that offer goods or services to people located in Peru, or that monitor behaviour or build profiles of them, and to controllers to whom Peruvian law applies by contract or by international law. Article VII then requires the appointment of a representative 'in Peruvian territory or for Peruvian territory', with the only exemption being processing purely for transit. Registration of every personal data bank with the National Registry of Personal Data Protection is a separate, long-standing duty under Article 34 of Law 29733.

Sector by sector, checked 19 August 2026. BANKING, INSURANCE, PENSIONS (data can leave with paperwork): SBS Resolution 504-2021 permits offshore processing and cloud, but a regulated firm must ask the Superintendency for prior authorisation before hiring a significant offshore data-processing service where the foreign legal framework limits the Superintendency's access, audit or exit rights; the authorisation is specific to the provider, country and city. Firms must also notify the Superintendency within 30 calendar days of starting any significant third-party data processing, and evidence ISO/IEC 27001, 27017, 27018 and a SOC 2 Type 2 report annually for cloud. SECURITIES (data can leave with paperwork): no separate localisation rule found on the SMV's own site; the general regime and operational-risk rules apply. HEALTH (data can leave with paperwork): no localisation rule found; the binding constraint is retention, not location. TELECOMS (data can leave with paperwork): no localisation rule, but Legislative Decree 1182 requires operators to hold traffic and location data for 12 months in systems that answer Peruvian police online and in real time, then 24 months more in archive - a practical pull towards in-country infrastructure. GOVERNMENT CLOUD (data can leave with paperwork): the digital government regulation tells public bodies to prefer cloud, and the Digital Government Secretariat's cloud guidance expressly says restrictive data-location rules would breach Peru's free trade commitments; it only suggests that bodies holding mass sensitive data with national security characteristics may choose to keep those in-country. GAMBLING (data can leave with paperwork): no server-location rule, but the operator must be a Peruvian company or a Peruvian branch, must give the trade ministry usernames and passwords to its servers and databases within 10 working days of licensing, and must transmit economic and technical data to the ministry's data centre every single day. GEOSPATIAL, EDUCATION, DEFENCE: no cross-border storage rule located, checked 19 August 2026, confidence medium.

Article 18 of the 2024 Regulation sets the adequacy-first rule; Article 19 says the Directorate General issues a resolution determining whether a country is adequate, using four criteria (a legal framework, processing principles, enforceable individual rights, and a supervisory authority), and that the assessment is dispensable where the country has signed common data protection standards with Peru. Article 20 supplies the fallback: model contractual clauses or other legal instruments imposing at least the same obligations. Those model clauses were approved back in 2022 by Directoral Resolution 0074-2022-JUS/DGTAIPD, adopting the Ibero-American network's model. Article 21.2 makes notification and registration of the flow mandatory in every case. Law 29733 Article 15 also carries seven statutory exceptions that switch off the guarantee requirement entirely - international treaties, judicial cooperation, intelligence cooperation against serious crime, performance of a contract with the individual (expressly including user authentication, service improvement and support, quality monitoring, maintenance and billing), banking and stock-market transfers, medical treatment and epidemiological studies with disassociation, and the individual's prior express consent.

The authority is legally the Directorate General for Transparency, Access to Public Information and Personal Data Protection within MINJUSDH; its director as of January 2026 was Eduardo Luna Cervantes. Comparable 2024 figures were 454 entities inspected, 133 penalty proceedings and about 13.4 million soles in fines. Two caveats on how hard it actually bites: collection is weak (about 1.9 million soles of the 2025 fines had been collected by January 2026, partly because of a 40 per cent prompt-payment discount and appeals), and the statutory ceiling is low - 100 tax units, about 550,000 soles or roughly 157,000 dollars, and never more than 10 per cent of the previous year's gross revenue. The authority also runs a public register of sanctioned organisations, publishes a fine-calculation methodology adopted at the end of December 2025, and reports advisory decisions. Sector regulators that enforce in parallel: the Superintendency of Banking, Insurance and Pension Funds, the National Digital Security Centre inside the Digital Government Secretariat, the trade ministry's gaming directorate, and the telecoms regulator OSIPTEL.

Ceiling: Article 31.2 of the 2024 Regulation caps a processor's retention at two years from the end of the last assignment and states that indefinite retention is prohibited as a general rule. Floor: Article 47 of the same Regulation requires logs of user accounts, sessions and actions on personal data to be kept for a minimum of two years, and interaction logs to be generated continuously and available immediately. Legislative Decree 1182 requires 12 months of telecoms-derived data in live systems plus 24 months archived. Article 87(7) of the Tax Code requires books, records and supporting documents to be kept while the tax is not yet time-barred. Health Technical Standard 139-MINSA/2018 keeps a clinical record in the active file for five years after the last consultation, then fifteen years in the passive archive - twenty years in total before it can be proposed for destruction, and a minimum summary must be preserved even then; occupational cancer records run forty years. Where floor and ceiling collide, the express legal duty wins and the general two-year cap yields.

The privacy clock is Article 34.1 of the 2024 Regulation. The notification must describe the nature of the incident, the types and approximate number of people affected, the contact point, the likely consequences and the remedial measures. Article 36 requires a processor to tell its client immediately. The digital security clock is Article 32.1 of the Regulation of the Digital Trust Framework, Supreme Decree 126-2025-PCM, published 4 November 2025; Article 18 expressly says notifying the Digital Security Centre does not excuse you from notifying the privacy authority. Government has made this slightly easier by launching a single online incident form in September 2025 that feeds both regimes. A third, softer clock sits in finance: SBS Resolution 504-2021 requires firms to report a significant third-party data processing arrangement within 30 calendar days of it starting.

(1) Registration: Article 34 of Law 29733 plus Articles 41 to 44 of the 2024 Regulation, and the separate cross-border flow filing under Article 21.2. (2) Processor retention: Article 31.2. (3) Children: Articles 22 and 25 of the Regulation - consent of the parent or guardian for under-14s, but 14 to 17 year olds may consent themselves for digital services if the information is put in language they can understand, and the controller must make reasonable efforts to verify who is giving consent. Article 23 also bans collecting data about the rest of a child's family through the child. (4) Gambling: Article 38(r) of the gaming Regulation - credentials to servers and databases within 10 working days of licensing, plus Article 48 requiring the same on demand during inspections, plus a daily data feed to the ministry's data centre 365 days a year. (5) Criminal exposure: Peru punishes illegal trafficking in personal data under Article 154-A of the Criminal Code, separately from the administrative fine regime; we have not been able to open an official consolidated copy of that article, so it is flagged as unconfirmed. A sixth item worth knowing: the duty to appoint a Personal Data Officer arrives in waves by company size, and the first wave already passed on 30 November 2025.

The staggered Personal Data Officer deadlines run from publication of the Regulation on 30 November 2024: large firms above 2,300 tax units of annual sales had to comply by 30 November 2025, medium firms between 1,700 and 2,300 units by 30 November 2026, small firms between 150 and 1,700 units by 30 November 2027, and micro firms by 30 November 2028. The Personal Data Officer Directive, Directoral Resolution 100-2025-JUS/DGTAIPD, took effect at the end of December 2025 alongside a new fine-calculation methodology. Peru's artificial intelligence law regulation, Supreme Decree 115-2025-PCM of 9 September 2025, is now in force and interacts with profiling and automated decision rules. DORMANT SWITCHES, each of which can change the picture with no consultation: (1) the authority can issue a resolution declaring any country adequate - or by implication decline to - under Article 19, and the list is currently empty; (2) Article 19.3 lets Peru bypass assessment entirely for any country that signs common data protection standards with it, so a single treaty could open a corridor overnight; (3) the Digital Government Secretariat has yet to publish the national classification of digital security incidents and the notification protocols promised within 90 to 120 working days of the November 2025 Digital Trust Regulation, and those will set the deadlines for everything below critical level. PROPOSED, NOT LAW: Bill 07919/2023-CR, approved by the Congressional Economy Committee on 5 November 2025, would amend Article 28 of Law 29733 to oblige controllers and processors to run prevention, education and digital security programmes.