Peru

Article VI of the Regulation approved by Supreme Decree 016-2024-JUS extends the rules to companies not established in Peru. It catches you if you offer goods or services to people located in Peru. It also catches you if you monitor their behaviour or build profiles of them. It catches you as well if Peruvian law applies to you by contract or by international law. Article VII then requires you to appoint a representative 'in Peruvian territory or for Peruvian territory'. The only exemption is where the data merely passes through. Registering every personal data bank with the National Registry of Personal Data Protection is a separate, long-standing duty under Article 34 of Law 29733.

Here is what we found industry by industry, checked 19 August 2026. BANKING, INSURANCE, PENSIONS (data can leave only if conditions are met): Resolution 504-2021 of the Superintendency of Banking, Insurance and Pension Funds allows data handling and cloud services abroad. But a supervised firm must ask the Superintendency for permission first before hiring a significant data-handling service abroad, where the foreign country's laws limit the Superintendency's access, audit or exit rights. The permission covers one named provider, country and city. Firms must also tell the Superintendency within 30 calendar days of starting any significant data work with a third party. For cloud they must show ISO/IEC 27001, 27017 and 27018 certification and a SOC 2 Type 2 report every year. SECURITIES (data can leave only if conditions are met): we found no separate rule about keeping data in the country on the site of the Superintendency of the Securities Market. The general rules and the operational risk rules apply. HEALTH (data can leave only if conditions are met): we found no rule about keeping data in the country. The binding limit is how long you keep records, not where they sit. TELECOMS (data can leave only if conditions are met): there is no rule about keeping data in the country. But Legislative Decree 1182 makes operators hold traffic and location data for 12 months, in systems that answer Peruvian police online and in real time. They then hold it for 24 months more in archive. That pulls you towards infrastructure inside Peru. GOVERNMENT CLOUD (data can leave only if conditions are met): the digital government rules tell public bodies to prefer cloud. The Digital Government Secretariat's cloud guidance expressly says rules restricting where data sits would breach Peru's free trade commitments. It only suggests that bodies holding large amounts of sensitive data linked to national security may choose to keep it in the country. GAMBLING (data can leave only if conditions are met): there is no rule about where servers must sit. But the operator must be a Peruvian company or a Peruvian branch. It must give the trade ministry usernames and passwords to its servers and databases within 10 working days of licensing. It must also send economic and technical data to the ministry's data centre every single day. GEOSPATIAL, EDUCATION, DEFENCE: we found no rule about storing data abroad, checked 19 August 2026, confidence medium.

Article 18 of the 2024 Regulation puts the safe-enough country first. Article 19 says the Directorate General issues a decision on whether a country is safe enough. It uses four tests: a set of laws, principles for using data, rights individuals can enforce, and a supervisory authority. That assessment can be skipped where the country has signed common data protection standards with Peru. Article 20 gives the fallback: model contract clauses, or another legal document that imposes at least the same duties. Those model clauses were approved back in 2022 by Directoral Resolution 0074-2022-JUS/DGTAIPD, adopting the Ibero-American network's model. Article 21.2 makes it compulsory to notify and register the flow in every case. Law 29733 Article 15 also carries seven exceptions that switch off the guarantee requirement entirely. They are international treaties, judicial cooperation, intelligence cooperation against serious crime, performing a contract with the individual, banking and stock-market transfers, medical treatment and epidemiological studies with names removed, and the individual's prior express consent. The contract exception expressly includes user authentication, service improvement and support, quality monitoring, maintenance and billing.

The authority is legally the Directorate General for Transparency, Access to Public Information and Personal Data Protection. It sits inside the Ministry of Justice and Human Rights. Its director as of January 2026 was Eduardo Luna Cervantes. The 2024 figures were 454 entities inspected, 133 penalty proceedings and about 13.4 million soles in fines. Two things soften the impact. Collection is weak. Only about 1.9 million soles of the 2025 fines had been collected by January 2026, partly because of a 40 per cent discount for prompt payment and partly because of appeals. The maximum fine is also low. It is 100 tax units, about 550,000 soles or roughly 157,000 dollars, and never more than 10 per cent of the previous year's gross revenue. The authority runs a public register of punished organisations. It publishes a fine-calculation method adopted at the end of December 2025. It also reports advisory decisions. Other regulators enforce alongside it: the Superintendency of Banking, Insurance and Pension Funds, the National Digital Security Centre inside the Digital Government Secretariat, the trade ministry's gaming directorate, and the telecoms regulator OSIPTEL.

Maximum: Article 31.2 of the 2024 Regulation caps a supplier's keeping period at two years from the end of the last assignment. It says keeping data indefinitely is banned as a general rule. Minimums: Article 47 of the same Regulation requires logs of user accounts, sessions and actions on personal data to be kept for at least two years. Interaction logs must be generated continuously and be available immediately. Legislative Decree 1182 requires 12 months of telecoms data in live systems, plus 24 months in archive. Article 87(7) of the Tax Code requires books, records and supporting documents to be kept while the tax is not yet time-barred. Health Technical Standard 139-MINSA/2018 keeps a clinical record in the active file for five years after the last consultation, then fifteen years in the passive archive. That is twenty years in total before anyone can propose destroying it. A minimum summary must be kept even then. Occupational cancer records run forty years. Where a minimum and the maximum collide, the express legal duty wins and the general two-year cap gives way.

The privacy clock is Article 34.1 of the 2024 Regulation. The notice must describe what happened, the types and rough number of people affected, the contact point, the likely consequences and what you are doing to fix it. Article 36 requires a supplier to tell its client immediately. The digital security clock is Article 32.1 of the Regulation of the Digital Trust Framework, Supreme Decree 126-2025-PCM, published 4 November 2025. Article 18 expressly says telling the Digital Security Centre does not excuse you from telling the privacy authority. The government made this a little easier in September 2025 by launching a single online incident form that feeds both. A third, softer clock sits in finance. Resolution 504-2021 of the Superintendency of Banking, Insurance and Pension Funds requires firms to report a significant data-handling arrangement with a third party within 30 calendar days of it starting.

(1) Registering: Article 34 of Law 29733, plus Articles 41 to 44 of the 2024 Regulation, plus the separate filing for flows out of Peru under Article 21.2. (2) How long a supplier may keep data: Article 31.2. (3) Children: Articles 22 and 25 of the Regulation. A parent or guardian must consent for under-14s. Children of 14 to 17 may consent themselves for digital services, if the information is written in language they can understand. The company must make reasonable efforts to check who is giving consent. Article 23 also bans collecting data about the rest of a child's family through the child. (4) Gambling: Article 38(r) of the gaming Regulation requires logins to servers and databases within 10 working days of licensing. Article 48 requires the same on demand during inspections. There is also a daily data feed to the ministry's data centre, 365 days a year. (5) Crime: Peru punishes illegal trafficking in personal data under Article 154-A of the Criminal Code. That sits separately from the fines. We could not confirm that article against an official consolidated copy, so it is flagged as unconfirmed. A sixth item is worth knowing. The duty to appoint a Personal Data Officer arrives in waves by company size. The first wave already passed on 30 November 2025.

The staggered Personal Data Officer deadlines run from publication of the Regulation on 30 November 2024. Large firms above 2,300 tax units of annual sales had to comply by 30 November 2025. Medium firms between 1,700 and 2,300 units must comply by 30 November 2026. Small firms between 150 and 1,700 units must comply by 30 November 2027. Micro firms must comply by 30 November 2028. The Personal Data Officer Directive, Directoral Resolution 100-2025-JUS/DGTAIPD, took effect at the end of December 2025, alongside a new fine-calculation method. Peru's artificial intelligence law regulation, Supreme Decree 115-2025-PCM of 9 September 2025, is now in force. It interacts with the rules on profiling and automated decisions. POWERS THE GOVERNMENT CAN USE WITH NO CONSULTATION. (1) Under Article 19 the authority can issue a decision declaring any country safe enough, or decline to. The list is currently empty. (2) Article 19.3 lets Peru skip the assessment entirely for any country that signs common data protection standards with it. A single treaty could open a route overnight. (3) The Digital Government Secretariat has not yet published the national classification of digital security incidents, or the notification protocols. Both were promised within 90 to 120 working days of the November 2025 Digital Trust Regulation. They will set the deadlines for everything below critical level. PROPOSED, NOT LAW: Bill 07919/2023-CR was approved by the Congressional Economy Committee on 5 November 2025. It would amend Article 28 of Law 29733 to make companies run prevention, education and digital security programmes.