← Global Privacy Laws Research Library
Ley No. 29733, Ley de Protección de Datos Personales
Personal Data Protection Law No. 29,733: Peru
Prepared by Shubhank Suman · Last reviewed
CURRENT AND IN FORCE
- Legal character
- National statute
- Region
- Latin America
What it covers
Law No. 29733 is Peru's principal general personal-data protection statute. Its purpose is to guarantee the fundamental right to protection of personal data recognised under Article 2(6) of the Peruvian Constitution through appropriate processing of personal data. The law applies to public and private processing and establishes principles, lawful processing requirements, individual rights, database regulation, security obligations, international transfers and enforcement. The Peruvian government continues to identify it as the principal privacy statute, while Supreme Decree No. 016-2024-JUS provides its current implementing regulation. (Gob.pe)
The current regulatory framework should therefore be read as:
Law No. 29733 + Supreme Decree No. 016-2024-JUS
rather than treating the 2011 statute in isolation.
Why it matters
Peru's framework is particularly relevant because it combines traditional data-protection principles with provisions concerning automated decisions, security, proportionality and data-subject rights.
The law is also important for Latin-American comparative research because Peru's framework has developed alongside the GDPR-influenced modernization of data-protection laws throughout the region.
Refer to it when
Use this law when researching:
- lawful processing of personal data
- consent
- purpose limitation
- proportionality
- sensitive personal data
- information duties
- access and correction
- deletion
- opposition
- automated decision-making
- database registration
- security measures
- international transfers
- sanctions.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
The law is not an AI Act, but it is relevant where AI:
- processes Peruvian personal data
- creates profiles
- evaluates individuals
- makes or supports significant decisions
- processes biometric/health information
- transfers training or operational datasets.
The most important AI/privacy issue is therefore automated processing and profiling under the general personal-data framework.
Cybersecurity
HIGH
Security is embedded in the statutory processing principles and significantly elaborated through the 2024 Regulation.
Applicability
Public and private entities that process personal data within the territorial scope of Peruvian law.
Current validity
CURRENT.
The current framework comprises both:
Law No. 29733
and
Supreme Decree No. 016-2024-JUS
because the Regulation contains much of the operational detail. (Gob.pe)
Read first
Articles 4–10 → Articles 18–25 → security → international transfers → Supreme Decree No. 016-2024-JUS.
Provisions / sections covered
Articles 4–10: Fundamental processing principles
These provisions establish the core processing architecture, including:
- legality
- consent
- purpose
- proportionality
- data quality
- security
- transparency.
The proportionality principle is particularly important because processing must be appropriate, relevant and not excessive for the purpose pursued.
Articles 18–22: Data-subject rights
The framework provides rights concerning:
- information
- access
- updating
- inclusion
- rectification
- deletion
- opposition.
Automated decision-making
The original statutory framework also contains a provision concerning decisions based on personal-data processing that evaluate aspects of an individual's personality or conduct. This makes the law particularly relevant to profiling and AI-assisted decisions.
Security
The statute's security principle requires appropriate legal, organisational and technical measures proportionate to the nature of the processing and data involved.
International transfers
Cross-border transfers are governed through adequacy/appropriate-protection mechanisms and the implementing regulations.
2024 Regulation
The current implementing Regulation, Supreme Decree No. 016-2024-JUS, was published on 30 November 2024 and replaced the previous regulatory framework. The official text states that it contains 135 articles, six final complementary provisions and two transitional provisions. (Gob.pe)
This Regulation is therefore essential for a practical compliance analysis.
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Erasure and deletion
- Profiling
- Automated decision-making
- Security
- Cross-border transfers
- Data protection officer
- Biometrics
- Health data
- Enforcement and penalties
- Registration and notification
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.