Did Peru update its privacy regulation?

Yes. A new implementing regulation took effect in 2023, modernising Peru's 2011 Personal Data Protection Law and strengthening obligations on consent, security, and breach handling.

What kind of consent does Peru require?

Consent must generally be prior, free, express, informed, and unequivocal, which aligns with an opt-in approach. Sensitive data requires written consent.

Latin America & Caribbean

Cookie consent in Perú

Consent and privacy law in Perú

Peru's Personal Data Protection Law No. 29733 dates from 2011 and is overseen by the National Authority for the Protection of Personal Data. A new implementing regulation took effect in 2023, modernising the regime and strengthening obligations around consent, security, and breach handling. Peru historically operated a registry of personal data banks. Consent must generally be prior, free, express, informed, and unequivocal, which aligns it with an opt-in approach, and sensitive data requires written consent. Privacy notices in Spanish are expected. Cross border transfer rules apply, and the authority has become more active under the updated regulation.

Authority

Autoridad Nacional de Protección de Datos Personales

Status

Law No. 29733 since 2011, with a new implementing regulation in force from 2023

Primary law

Law 29733

Languages

Español (Latinoamérica)

Who must comply

Law 29733 applies to organisations and other entities that process personal data within the scope of Peru’s data protection framework.

Penalties

Fines tied to tax units, reaching substantial amounts for serious violations

Key obligations

Obtain valid consent where consent is the applicable legal basis.
Ensure consent is free, prior, express, unequivocal, and informed.
Clearly communicate the purpose of data processing.
Provide appropriate privacy information to individuals.
Respect data subject rights.
Implement appropriate technical and organisational security measures.
Register personal data databases where registration is required.
Establish procedures for handling data subject requests.
Assess requirements for international transfers and disclosures.
Maintain appropriate evidence demonstrating compliance.

Local guidance

Apply the updated implementing regulation from 2023
Use prior, free, express, informed, and unequivocal consent
Provide notices in Spanish
Check cross border transfer requirements

How ConsentX helps

Prior and express consent capture: Capture consent before applicable cookies, trackers, or processing activities are activated.
Purpose-based consent: Present clear information about the purposes for which personal data and tracking technologies are used.
Cookie and tracker management: Scan websites to identify cookies and trackers and control the activation of applicable non-essential technologies.
Consent records: Create auditable consent records containing information about users’ choices and the consent event.
Data subject request management: Support workflows for receiving and managing privacy requests, including access, rectification, cancellation, and opposition requests.
Regional compliance: Apply jurisdiction-specific consent rules through ConsentX’s region rule engine.

Get started free

yoursite.com

Perú

We value your privacy

We ask for your consent before any non-essential cookie, with the rules that apply in your region.

Allow allReject non-essentialManage preferences

Consent recorded

sha256 · chain ok

This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.

Get Perú ready with ConsentX

Geo-aware banners, prior-script blocking, DSAR and tamper-evident evidence.

Get started free Book a demo

How to comply with Perú using ConsentX

1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Perú.
2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Perú requires, automatically.
3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Perú audit.
5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.