Personal Data Protection Law (Ley de Proteccion de Datos Personales)

Peru substantially modernized its regime not by amending the 2011 Law but by replacing its implementing regulation: Supreme Decree 016-2024-JUS took effect March 30, 2025, adding data-protection officer requirements, breach-notification duties to the Autoridad Nacional de Proteccion de Datos Personales, privacy-by-design expectations, and — most relevant to foreign businesses — an expanded territorial reach extending to controllers outside Peru that use means located in Peru or direct processing activities at people in Peru. Because that extraterritorial expansion sits in a regulation interpreting a statute that itself lacks an explicit targeting clause, the triggers below are modeled generously but flagged: confirm the specific basis with Peruvian counsel before relying on either coverage or non-coverage. Database registration with the national authority remains a standing obligation.