Regulationsby GlyphJurisdiction
Peru: data, AI and cyber laws
Part of Americas.
Regulations
Add to calendar
Peru PDPL and 2024 RegulationPeru's 2011 data protection law now runs under a new regulation that replaced the 2013 rules. The regulation adds 48-hour breach notification to the authority, data protection officers phased in by company size, data portability, stronger rules for processors and cross-border transfers, and detailed sanctions procedures.Next: Nov 30 DPO required: medium companies · in 34 daysPeru AI Law and RegulationPeru's AI law and its 2025 regulation set a risk-based framework with prohibited uses and high-risk uses (for example in credit, employment, health and education access). Developers and deployers of high-risk systems must run impact assessments, keep human oversight and give transparency. Obligations phase in by sector and company size over one to four years.Next: Sep 10, 2027 Private sector: transport, commerce, labour · in 10 months
Upcoming deadlines
Peru PDPL and 2024 RegulationDPO required: medium companiesCompanies with annual sales above 1,700 UIT up to 2,300 UIT.PeruPeru AI Law and RegulationPrivate sector: transport, commerce, labourObligations apply two years after publication.PeruPeru PDPL and 2024 RegulationDPO required: small companiesCompanies with annual sales above 150 UIT up to 1,700 UIT.PeruPeru AI Law and RegulationPrivate sector: production, agriculture, energy, miningObligations apply three years after publication.PeruPeru PDPL and 2024 RegulationDPO required: micro companiesMicro companies with annual sales up to 150 UIT.PeruPeru AI Law and RegulationPrivate sector: all other usesObligations apply four years after publication.Peru
Past deadlines
Peru AI Law and RegulationPrivate sector: health, education, justice, security, financeHigh-risk and related obligations apply one year after publication for these sectors.PeruPeru AI Law and RegulationRegulation in forceRegulation enters into force 90 business days after publication. Date computed with national holidays, so tentative.PeruPeru PDPL and 2024 RegulationDPO required: large companiesCompanies with annual sales above 2,300 UIT must appoint a data protection officer where Art. 37.1(2)-(3) applies.PeruPeru PDPL and 2024 RegulationData portability appliesArticle 76 on portability takes effect six months after the regulation enters into force.PeruPeru AI Law and RegulationRegulation publishedDS 115-2025-PCM approving the AI regulation published in El Peruano.PeruPeru PDPL and 2024 RegulationNew regulation in forceRegulation enters into force 120 calendar days after publication.PeruPeru PDPL and 2024 RegulationNew regulation publishedDS 016-2024-JUS published in El Peruano.PeruPeru AI Law and RegulationLaw 31814 publishedAI promotion law published.Peru