Peru Law 29733 Compliance with ConsentX

Consent requirements

Consent is a central element of Peru's data protection framework.

Where consent is required, organisations must generally obtain it before processing begins, and the consent must be:

• Free
• Prior
• Express
• Unequivocal
• Informed

Consent should be distinguishable from other terms or conditions and should provide individuals with sufficient information to understand what they are agreeing to.

However, organisations should not assume that consent is required for every processing activity. Law 29733 contains circumstances in which personal data may be processed without consent.

Sensitive personal data

Sensitive personal data receives enhanced protection under Peru's data protection framework.

Organisations handling sensitive information should apply the additional requirements and safeguards established by Law 29733 and its Regulation.

Privacy notices and consent mechanisms should clearly explain the relevant categories of data and the purposes for which sensitive information will be processed.

Data subject rights

Law 29733 gives individuals rights over their personal data.

These include the ARCO rights:

• Access - individuals can request information about their personal data and relevant processing activities.
• Rectification - individuals can request correction of inaccurate, incomplete, or outdated personal data.
• Cancellation - individuals can request the deletion or cancellation of their personal data where the applicable legal requirements are satisfied.
• Opposition - individuals can object to certain processing of their personal data when the applicable requirements for opposition are met.

Organisations should establish clear processes for receiving, authenticating, tracking, and responding to these requests.

Privacy notices and transparency

Organisations should provide individuals with clear information about the processing of their personal data.

A privacy notice should address relevant information such as:

• Categories of personal data collected
• Purposes of processing
• How personal data is used
• Relevant recipients
• International transfers, where applicable
• Data subject rights
• How individuals can exercise their rights
• Other information required under the applicable framework

The current Regulation reinforces transparency and information requirements for personal data processing.

Security and accountability

Organisations must implement appropriate security measures to protect personal data against risks such as unauthorised access, loss, alteration, disclosure, or destruction.

The 2024 Regulation strengthens the compliance and accountability framework and introduces additional mechanisms for organisations to demonstrate that appropriate data protection measures are in place.

Organisations should therefore maintain appropriate documentation, policies, procedures, technical controls, and evidence of compliance.

Data security incidents

The current Regulation introduces requirements concerning notification of certain personal data security incidents.

The ANPD states that incidents involving personal data must be notified to the authority within 48 hours of becoming aware of the incident, where the applicable notification requirement is triggered.

Organisations should therefore maintain an incident response process capable of identifying, assessing, documenting, and escalating personal data breaches within the required timeframe.

International data transfers

Organisations transferring personal data outside Peru should assess the applicable requirements under Law 29733 and its Regulation.

Before transferring personal data internationally, organisations should consider:

• The destination country
• The recipient
• The purpose of the transfer
• Applicable safeguards
• The legal basis for the transfer
• Contractual requirements
• Any applicable notification or authorisation requirements

International transfers should form part of the organisation's broader data mapping and privacy compliance programme.

Personal data database registration

Peru's data protection framework includes requirements concerning the registration of personal data databases.

Organisations should determine which databases are subject to registration and ensure that required registrations and updates are maintained.

Database registration should be considered alongside privacy notices, processing purposes, security controls, and data subject rights procedures.

Cookies and online tracking

Cookies, pixels, analytics tools, advertising technologies, and other online tracking technologies may involve the processing of personal data.

Organisations operating websites in Peru should therefore assess:

• What cookies and trackers are deployed
• What information they collect
• Whether they process personal data
• The purpose of each technology
• Whether consent is required
• Whether data is transferred to third parties
• Whether information is transferred internationally

A consent management platform can help organisations identify trackers, communicate processing purposes, obtain consent where required, and prevent applicable technologies from running before consent.