PERU Law and Practice Contributed by: Alfred Kossuth Wieland and Edgardo Bernal Santos, Thorne, Echeandia & Lema Abogados
With respect to territorial scope, Peruvian data pro - tection rules include scenarios in which their effects may extend to foreign investors or entities. Article 3 of Law No 29733 provides that the law applies to the processing of personal data carried out within the Peruvian territory, but the Regulations broaden this scope by establishing that the law also applies where the owner of the database or the data controller has an establishment in Peru, even if the processing is carried out by a processor located abroad. In addi - tion, the rules apply to controllers not established in Peru where they are subject to Peruvian law by virtue of contractual provisions or rules of international law, or where they use means located in Peru for the pro - cessing of personal data, subject to certain excep - tions. As a result, a foreign investor may be subject to these rules even without having a physical presence in Peru, depending on how personal data linked to Peru is processed.
In terms of oversight and enforcement, the National Authority for Personal Data Protection (ANPDP), which operates under the Ministry of Justice, is the body responsible for supervising compliance with Law No 29733 and its Regulations. The ANPDP is empow - ered to impose sanctions and corrective measures in cases of non-compliance, and to issue guidance and interpretative criteria on the applicable regulations. The Law highlights the central role of the ANPDP in the effective enforcement of Peru’s data protec - tion regime and in the promotion of good practices, although it does not provide specific details regarding sanction multipliers or the relationship between fines and demonstrable economic harm, beyond recognis - ing the Authority’s sanctioning and corrective powers.
458 CHAMBERS.COM
Powered by FlippingBook