Regulationsby GlyphPeru PDPL and 2024 Regulation
Amended Peru · In force Mar 30, 2025 · next deadline Nov 30, 2026 (in 34 days)
Deadlines
Coming up
DPO required: medium companiesCompanies with annual sales above 1,700 UIT up to 2,300 UIT.
DPO required: small companiesCompanies with annual sales above 150 UIT up to 1,700 UIT.
DPO required: micro companiesMicro companies with annual sales up to 150 UIT.
Already passed
DPO required: large companiesCompanies with annual sales above 2,300 UIT must appoint a data protection officer where Art. 37.1(2)-(3) applies.
Data portability appliesArticle 76 on portability takes effect six months after the regulation enters into force.
New regulation in forceRegulation enters into force 120 calendar days after publication.
New regulation publishedDS 016-2024-JUS published in El Peruano.
Summaries for reference, not legal advice. Check the official text.
What it does
Peru's 2011 data protection law now runs under a new regulation that replaced the 2013 rules. The regulation adds 48-hour breach notification to the authority, data protection officers phased in by company size, data portability, stronger rules for processors and cross-border transfers, and detailed sanctions procedures.
- Who it applies to
- Controllers and processors of personal data in Peru, and processing outside Peru in cases set by the regulation.
- Penalties
- Fines under Law 29733 graded by severity up to 100 UIT per infraction, plus coercive fines of up to 100 UIT for failing to follow orders.
- Enforced by
- Autoridad Nacional de Protección de Datos Personales (Ministerio de Justicia y Derechos Humanos)
- Official name
- Ley N° 29733, Ley de Protección de Datos Personales, and its Regulation (Decreto Supremo N° 016-2024-JUS)
- Citation
- Ley N° 29733; Decreto Supremo N° 016-2024-JUS
- Topics
- Privacy, Breach notification, Data residency
Verified 2026-09-25
Research notes
enacted_date is the regulation's publication date; Law 29733 itself dates from 2011. The 2025-09-30 portability date is computed as six months after entry into force, hence tentative.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setCanada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date setChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysMexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025
Questions about Peru PDPL and 2024 Regulation
- What are the Peru PDPL and 2024 Regulation compliance deadlines?
- Nov 30, 2024: New regulation published. Mar 30, 2025: New regulation in force. Sep 30, 2025: Data portability applies (tentative). Nov 30, 2025: DPO required: large companies. Nov 30, 2026: DPO required: medium companies. Nov 30, 2027: DPO required: small companies. Nov 30, 2028: DPO required: micro companies.
- When does Peru PDPL and 2024 Regulation take effect?
- Peru PDPL and 2024 Regulation took effect on Mar 30, 2025. The next milestone is Nov 30, 2026: DPO required: medium companies.
- Who does Peru PDPL and 2024 Regulation apply to?
- Controllers and processors of personal data in Peru, and processing outside Peru in cases set by the regulation.
- What are the penalties under Peru PDPL and 2024 Regulation?
- Fines under Law 29733 graded by severity up to 100 UIT per infraction, plus coercive fines of up to 100 UIT for failing to follow orders.