Ley 29733, Ley de Proteccion de Datos Personales — cross-border flow of personal data

Art. 15 permits cross-border flows only where the destination country maintains levels of protection equivalent to those the Law requires, or where a Peruvian treaty provides otherwise, with Art. 11's adequate-protection principle underpinning it. The 2024 Reglamento, which replaced the 2013 one and commenced in late March 2025, is the document that made this workable: it sets out the criteria the Autoridad Nacional de Proteccion de Datos Personales applies in assessing whether a destination offers an adequate level, and clarifies the routes available where it does not. Marked 'check': the operative texts are Spanish-language, the Reglamento is recent, and the specific safeguard instruments it recognises were not confirmed against the primary text — read the Reglamento directly before selecting a transfer mechanism.