🇵🇪Law 29733 and Supreme Decree 016-2024-JUS
Law 29733 and Supreme Decree 016-2024-JUS
Law 29733 protects the fundamental right to personal-data protection. The 2024 regulation provides the current operational rules and should be read together with the Law.
Core duties
The regulation requires free, prior, express, unequivocal and informed consent unless an exception applies; special handling for sensitive data, minors, direct marketing and automated decisions; and records supporting domestic and cross-border transfers.
Controllers must register and maintain their personal-data banks, use processor and subprocessor controls, adopt a security document and access safeguards, notify qualifying security incidents, and appoint an official for personal data where the statutory trigger applies.
Rights processes must support information, access, rectification, inclusion, deletion, objection and objective treatment, using the deadlines and escalation procedures stated in the regulation.