PERU Law and Practice Contributed by: Alvaro Echeandía, Alfred Kossuth Wieland, Pilar Santillán Meza and Rodrigo Varillas Cueto, Thorne, Echeandia & Lema Abogados
computer services (whether computerised or not, public or private) do not provide information that affects their personal and family privacy. In addition, Law No 29733, Law on Personal Data Protection, governs the processing of personal information in the country. Enacted in 2011, this law establishes the principles, rights and obliga - tions related to personal data protection, aiming to guarantee the exercise of the right to privacy and informational self-determination of Peruvian citizens. The law sets forth principles such as informed consent, the purpose of processing, data quality, and information security and grants data subjects various rights, including access, rectification, cancellation, and opposition (ARCO rights). Additionally, it establishes the creation of the National Authority for the Protection of Personal Data (ANPDP), which is responsible for overseeing compliance with the law and ensur - ing adequate protection of personal data in the country. Law No 29733 is an important pillar in the Peruvian legal framework for the protection of privacy and personal information security. The Supreme Decree No 016-2024-JUS, Regu - lation of Law No 29733, enacted in 2024, estab - lishes specific procedures and technical guide - lines for the effective implementation of Law No 29733. Among the most notable aspects of the Regulation are the definition of key concepts related to data protection, the regulation of the rights and obligations of those responsible for processing personal data as well as the rights of data subjects. Additionally, the Regulation provides detailed guidelines on the procedure for exercising ARCO rights (Access, Rectifica - tion, Cancellation, and Opposition) and for the registration of databases in the National Registry of Personal Data Protection. It also establishes the security measures that must be implemented by data processors to ensure the integrity and
confidentiality of personal information. In sum - mary, Supreme Decree No 016-2024-JUS com - plements Law No 29733 by providing a detailed and specific regulatory framework for personal data protection in Peru, thereby contributing to its effective application and safeguarding the privacy rights of citizens. 8.2 Geographical Scope Article 3 of Law No 29733 establishes the scope of application of the law, stating that it applies to personal data contained or intended to be contained in databases of both the public and private administration, whose processing is car - ried out within the national territory. On the other hand, Section VI of the Preliminary Title of Supreme Decree No 016-2024-JUS establishes the territorial scope of application of the Law and the Regulation. Said article expands the scope of the law to the processing of person - al data carried out in an establishment located in Peruvian territory corresponding to the hold - er of the database or the data controller, even when the processing is carried out by a data processor, regardless of their location. In addi - tion, the Law and the Regulation are applicable if the database holder or data controller is not established in Peruvian territory but is subject to Peruvian legislation by contractual provision or international law or if they use means located in Peruvian territory for data processing, with some exceptions. In summary, Article 3 of Law No 29733 establish - es the general scope of application of the Law, while Section VI of the Preliminary Title expands this scope by establishing specific conditions under which the Law and the Regulation apply to foreign companies operating in Peru or col - lecting data from Peruvian citizens, even if they do not have a physical presence in the country.
663 CHAMBERS.COM
Powered by FlippingBook