Ley 29733, Ley de Proteccion de Datos Personales — notification of security breaches

Peru had no meaningful breach-notification machinery until the 2024 Reglamento replaced the 2013 one. Since it commenced in late March 2025, a controller that detects — or has indications of — a security incident affecting personal data must notify the Autoridad Nacional de Proteccion de Datos Personales within 48 hours, and must notify affected data subjects within 48 hours of becoming aware where the incident affects their rights. Forty-eight hours is tighter than the GDPR's 72, and the trigger is deliberately early: 'indications of' an incident starts the clock, not confirmation of one. The Reglamento also extended the law's territorial reach and brought biometric data expressly within the sensitive-data category. Marked 'check': the operative texts are Spanish-language and the regime is recent enough that enforcement practice around what counts as an 'indication' is not yet settled.