Peru’s new Regulation of the Personal Data Protection Law (Supreme Decree 016-2024-JUS) comes into force today, replacing the 2013 regulation under Law No. 29733.
Key points
- A DPO is required for certain processing, phased by company size.
- Breaches must be notified to the authority within 48 hours.
- Security measures are updated.
- Databases must be registered.
UK organisations with Peruvian customers, employees or operations should review their breach procedures, security documentation and governance, including whether a DPO is required and when the phased deadline applies to them.
Source: Supreme Decree 016-2024-JUS (El Peruano)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
