Supreme Decree No. 016-2024-JUS: Regulation of Law No. 29733, Law on Personal Data Protection

“YEAR OF THE BICENTENNIAL, OF THE CONSOLIDATION OF OUR INDEPENDENCE, AND OF THE COMMEMORATION OF THE HEROIC BATTLES OF JUNÍN AND AYACUCHO” FOUNDED ON OCTOBER 22, 1825 BY THE LIBERATOR SIMÓN BOLÍVAR SPECIAL SEPARATA MINISTRY OF JUSTICE AND HUMAN RIGHTS SUPREME DECREE NO. 016-2024-JUS SUPREME DECREE APPROVING THE REGULATION OF LAW NO. 29733, LAW ON PERSONAL DATA PROTECTION LEGAL NORMS SATURDAY, November 30 of 2024

2 LEGAL NORMS Saturday, November 30, 2024 / El Peruano SUPREME DECREE APPROVING THE REGULATION OF LAW NO. 29733, LAW ON PERSONAL DATA PROTECTION SUPREME DECREE NO. 016-2024-JUS THE PRESIDENT OF THE REPUBLIC CONSIDERING:
That, paragraph 6 of Article 2 of the Political Constitution of Peru states that every person has the right to have public or private, computerized or non-computerized, information services not supply information that affects personal and family privacy; That, Article 1 of Law No. 29733, Law on Personal Data Protection, states that said Law has the object of guaranteeing the fundamental right to the protection of personal data, provided for in paragraph 6 of Article 2 of the Political Constitution of Peru, through its adequate treatment, within a framework of respect for the other fundamental rights recognized therein; That, Article 32 of the aforementioned Law provides that the Ministry of Justice and Human Rights exercises the National Authority for Personal Data Protection; That, by Supreme Decree No. 003-2013-JUS, the Regulation of Law No. 29733, Law on Personal Data Protection, was approved, which in its Article 1 states that its object is to develop the aforementioned Law, in order to guarantee the fundamental right to the protection of personal data, regulating adequate treatment, both by public entities and by institutions belonging to the private sector; That, Legislative Decree No. 1353, Legislative Decree that creates the National Authority for Transparency and Access to Public Information, Strengthens the Regime for the Protection of Personal Data and the Regulation of Interest Management, through its third complementary modifying provision, reformed some provisions of Law No. 29733, Law on Personal Data Protection; That, paragraph a) of paragraph 4.2 of Article 4 of Urgency Decree No. 007-2020, Urgency Decree that approves the Digital Trust Framework and provides measures for its strengthening, establishes that one of the scopes of digital trust in the digital environment is the protection of personal data and transparency, with the Ministry of Justice and Human Rights being the entity that exercises the National Authorities for Transparency, Access to Public Information, and Protection of Personal Data, and within the framework of its functions and competencies, regulates, directs, supervises, and evaluates the matter of transparency and personal data protection; That, by Legislative Decree No. 1412, Legislative Decree that approves the Digital Government Law, in paragraphs 5.3 and 5.10 of Article 5, the principles governing the digital government governance framework are established, namely the principle of privacy by design, whereby, in the design and configuration of digital services, preventive measures of a technological, organizational, human, and procedural nature are adopted; as well as, the principle of adequate level of protection for personal data, whereby, the treatment of personal data must be carried out in accordance with what is established in the Law on Personal Data Protection and its Regulation; That, due to changes in the regulatory framework and contemporary challenges represented by the emergence of new digital
technologies, it is necessary to approve a new Regulation of Law No. 29733, Law on Personal Data Protection, that allows the country to have a modern and solid regulatory framework that guarantees adequate protection of citizens' rights against the risks generated for personal data by the use of new digital technologies; That, by Ministerial Resolution No. 0270-2023-JUS, published on August 26, 2023, in the Official Newspaper El Peruano, the publication of the Draft Regulation of Law No. 29733, Law on Personal Data Protection, and the Statement of Motives supporting it, was ordered, for a period of thirty (30) calendar days, in order to receive suggestions, comments, or recommendations from public entities, private institutions, civil society organizations, as well as natural persons in general. That, the General Directorate of Transparency, Access to Public Information, and Personal Data Protection received, processed, and systematized the suggestions, comments, and/or recommendations presented by citizens and various institutions, both in the private and public spheres; In accordance with what is provided in paragraph 6) of Article 2 and paragraph 8 of Article 118 of the Political Constitution of Peru; Law No. 29733, Law on Personal Data Protection; Law No. 29158, Organic Law of the Executive Power; Urgency Decree No. 007-2020, Urgency Decree that approves the Digital Trust Framework and provides measures for its strengthening; Law No. 29809, Law on Organization and Functions of the Ministry of Justice and Human Rights; the Organization and Functions Regulation of the Ministry of Justice and Human Rights, approved by Supreme Decree No. 013-2017-JUS; and the Regulation of the Framework Law for the Production and Systematization of Legislation, approved by Supreme Decree No. 007-2022-JUS; With the approving vote of the Council of Ministers; DECREES:
Article 1. Approval
The Regulation of Law No. 29733, Law on Personal Data Protection, is approved, whose text is composed of one (1) Preliminary Title, three (3) Titles, one hundred thirty-five (135) articles, six (6) Final Complementary Provisions, and two (2) Transitory Complementary Provisions, which form an integral part of this Supreme Decree.
Article 2. Publication
This Supreme Decree and the Regulation approved in Article 1 are published on the Unique Digital Platform of the Peruvian State for Citizen Orientation (www.gob.pe) and on the digital headquarters of the Ministry of Justice and Human Rights and the Presidency of the Council of Ministers, on the same day of publication of this norm in the Official Newspaper El Peruano.
Article 3. Financing
The implementation of what is provided in this Supreme Decree and the Regulation approved in Article 1 is subject to the budgetary availability of the involved ministries, without demanding additional resources from the Public Treasury.
Article 4. Counter-signature
This Supreme Decree is counter-signed by the Minister of Justice and Human Rights.
COMPLEMENTARY PROVISION
DEROGATORY
Sole. Derogation
Supreme Decree No. 003-2013-JUS, which approves the Regulation of Law No. 29733, Law on Personal Data Protection, is repealed.
Given in the Government House, in Lima, on the twenty-ninth day of the month of November of the year two thousand twenty-four.
DINA ERCILIA BOLUARTE ZEGARRA
President of the Republic
EDUARDO MELCHOR ARANA YSA
Minister of Justice and Human Rights

El Peruano / Saturday, November 30, 2024 LEGAL NORMS 3 PRELIMINARY TITLE
Article I. Object
This Regulation has as its object to establish provisions for the adequate application of Law No. 29733, Law on Personal Data Protection, hereinafter referred to as the Law, in order to guarantee the fundamental right to the protection of personal data, regulating adequate treatment by natural persons, public entities, and institutions belonging to the private sector, particularly in the digital environment.
Article II. Purpose
This Regulation has the purpose of guaranteeing adequate protection of the fundamental right to the protection of personal data established in paragraph 6 of Article 2 of the Political Constitution of Peru and Law No. 29733, Law on Personal Data Protection, against the risks that the use of new digital technologies may generate.
Article III. Definitions
For the application of this Regulation, without prejudice to the definitions contained in the Law, the following definitions must be understood complementarily:

1. Personal data bank: It is the set of data of natural persons, computerized or not, and structured according to specific criteria, that allows access to personal data without disproportionate effort, whether centralized, decentralized, or distributed functionally or geographically.
2. Blocking: It is the measure consisting of the identification and reservation of personal data, adopting technical and organizational measures to prevent their treatment, including their visualization, during the period in which any request for update, inclusion, rectification, or suppression is being processed, in accordance with what is provided in the third paragraph of Article 20 of the Law.
   It is also established as a prior step to cancellation for the time necessary to determine possible responsibilities regarding treatments during the period of legal or contractually provided prescription.
3. Cancellation: It is the action or measure described in the Law as suppression, when referring to personal data, which consists of eliminating or suppressing personal data.
4. Personal data: It is that numerical, alphabetic, graphic, photographic, acoustic information, regarding personal habits, location, online identifiers, or of any other type concerning physical, economic, cultural, or social aspects of natural persons that identify them or make them identifiable. A person is considered identifiable when their identity can be verified directly or indirectly from the combination of data through means that can be reasonably used.
5. Personal data related to health: It is that information concerning the past, present, or predicted physical or mental health of a person, including information derived from a medical act, the degree of disability, and their genetic information.
6. Sensitive data: It is that information relating to genetic or biometric data of the natural person, neural data, moral or emotional data, facts or circumstances of their affective or family life, personal habits that correspond to the most intimate sphere, information relating to union affiliation, physical or mental health, or other analogous information that affects their privacy.
7. De-indexing: It is the process by which a specific URL or content of a website is removed or excluded from search engine results. This procedure, depending on the situation and specific circumstances, can be carried out by the owner of the website or by the search engine.
8. Days: Business days.
9. General Directorate of Transparency, Access to Public Information, and Personal Data Protection: It is the body in charge of exercising the National Authority for Personal Data Protection referred to in Article 32 of the Law, either of these designations may be used interchangeably in this Regulation.
10. Data processing agent: It is the natural person, private law legal person, or public entity that carries out data processing on behalf of or under the order of the data controller or owner of the personal data bank.
11. Profiling: It is the form of automated processing of personal data that allows evaluating aspects of a natural person, specifically and continuously, to analyze or predict aspects related to their professional performance, economic situation, health, personal preferences, interests, reliability, behaviors, or habits, location, or movements.
12. Data issuer or exporter: It is the owner of the personal data bank or that person who is responsible for the processing of said data, located within the national territory, who carries out a transfer of personal data to another country, in accordance with what is provided in this Regulation.
13. Data protection impact assessment: It is the proactive accountability mechanism consisting of the owner of the personal data bank or the data controller carrying out, prior to the processing of said data, an analysis or assessment of the impact or risks implied by the processing of such data.
14. Transit purposes: Implies that the media are not used for the specific purpose of carrying out the processing of personal data, such as processing, storage, download, visualization, and/or similar, but exclusively to pass personal data from one place to another.
15. Cross-border flow of personal data: The cross-border flow or international transfer of personal data is referred to as the transfer of personal data to a recipient located in a country different from the country of origin of the personal data, regardless of the medium on which they are found, the means by which the transfer was effected, nor the treatment they receive.
16. Personal data security incident: It is any breach of security that causes the destruction, loss, or unlawful alteration of personal data or the unauthorized communication or exposure of said data.
17. Data Officer: It is the person designated by the data controller or data processing agent for the verification, advice, and implementation of compliance with the legal regime on personal data protection.
18. Data recipient or importer: It is any natural or legal person of private law, including branches, subsidiaries, affiliated or similar entities, or public entities, that receives the data in case of international transfer, either as the owner of the personal data bank or as the data processing agent.
19. Rectification: It is that action intended to affect or modify a personal data, either to update it or correct it with exact data.
20. Representative: It is the natural or legal person expressly designated by the owner of the personal data bank or the controller, for the purposes of the processing of personal data.
21. Jurisprudence registry: It is the bank of judicial or administrative resolutions, tax opinions, arbitral awards, resolutions of ethics committees, or similar, which is in physical or digital support, and organizes, among others, personal data as a source of consultation and usually public.
22. Data controller: It is the natural person, private law legal person, or public entity that decides on the purpose and means of the processing of personal data. This definition is not restricted to the owner of the data bank, but includes any person who decides on the processing of personal data, even if they are not in a personal data bank.
23. Processing: It is any operation or set of operations, automated or not, that are carried out on personal data or sets of personal data.
24. Third party: It is any natural person, private law legal person, or public entity, distinct from the owner of the personal data, the owner of the data bank or data controller, the data processing agent, and the persons authorized to process the data under the direct authority of those.
    The reference to “third party” made in Article 30 of the Law constitutes an exception to the meaning provided in this paragraph.
    Article IV. Scope of application
    4.1 This Regulation applies to the processing of personal data, even when they are not in a personal data bank.
    4.2 It applies to any modality of processing of personal data, whether carried out by natural persons, public entities, or private sector institutions, regardless of the medium on which they are found.
    4.3 The existence of particular or special norms or regimes, even if they include regulations on personal data, does not exclude the public entities or private institutions to which such regimes apply from the scope of application of the Law and this Regulation.
    4.4 What is provided in the preceding paragraph does not imply the derogation or inapplicability of the particular norms, as long as their application does not generate the infringement of the right to the protection of personal data.
    Article V. Exceptions to the scope of application
    5.1 The provisions of the Law and this Regulation are not applicable to the following cases:
25. The processing of personal data carried out by natural persons for exclusively domestic, personal, or related to their private or family life purposes.
26. The personal data contained or intended to be contained in personal data banks of the public administration, only as long as the current purpose of the treatment is necessary for the strict compliance of competencies assigned by law to the respective public entities and always that they have as their object:
    a) National defense, b) Public security, c) The development of activities in criminal matters for the investigation and repression of crime.
    5.2 In the case that the public entities referred to in paragraph 2 of section 5.1 of this article carry out the processing of personal data for a purpose other than that linked to the strict compliance of their competencies, or for purposes of archive, administrative, historical, scientific, or statistical research, what is provided in the Law and in this Regulation is applicable to them insofar as pertinent.
    Article VI. Scope of application in and for Peruvian territory
    The provisions of the Law and this Regulation are applicable to the processing of personal data when:
27. It is carried out in an establishment located in Peruvian territory corresponding to the owner of the personal data bank or the person who is responsible for the processing.
28. It is carried out by a data processing agent, regardless of its location, on behalf of an owner of a data bank established in Peruvian territory or of the person who is the data controller.
29. The owner of the personal data bank or the person who is responsible is not established in Peruvian territory, but uses means located in said territory, unless such means are used solely for transit purposes that do not imply a processing of personal data. This provision comprises the following cases:
    3.1. The owner of the personal data bank or the person who is responsible for the processing is not in Peruvian territory, but carries out activities related to the offer of goods or services directed to the owners of personal data located in Peruvian territory.
    3.2. The owner of the personal data bank or the person who is responsible for the processing is not in Peruvian territory, but carries out activities oriented towards the analysis of behavior of the owners of personal data located in Peruvian territory, as well as the profiling that seeks to predetermine behaviors, preferences, habits, or similar.
30. The owner of the personal data bank or the person who is responsible for the processing is not established in Peruvian territory, but Peruvian legislation is applicable to them, by contractual provision or international law.
    El Peruano / Saturday, November 30, 2024 LEGAL NORMS 5 Peruvian territory, but Peruvian legislation is applicable to them, by contractual provision or international law.
    Article VII. Representative of the owner of the personal data bank or data controller
    7.1 For the purposes of what is provided in paragraphs 3 and 4 of Article VI, unless the processing is carried out for transit purposes, the owner of the personal data bank or the person who is responsible, located in Peruvian territory or outside of it, must provide the necessary means for the effective compliance with the obligations provided in the Law and the Regulation, and designate a representative in Peruvian territory or for Peruvian territory, which is the point of contact with the National Authority for Personal Data Protection.
    7.2 The owner of the personal data bank or the person who is responsible may carry out the designation of the representative, alternatively, in the following forms:
31. They may publicly inform it in the privacy policy of the owner of the personal data bank or data controller; or,
32. They may communicate it to the National Authority for Personal Data Protection, for which they must take into account what is established in the following paragraph 7.3.
    7.3 In the case that the designation of the representative is communicated to the National Authority for Personal Data Protection, the following cases must be taken into account:
33. For a representative in Peruvian territory: it must be carried out expressly through a valid document to materialize their representation, in accordance with Articles 53 and 115 of Law No. 27444, General Administrative Procedure Law, or the norm that substitutes it.
34. For a representative for Peruvian territory: the designation must be communicated to the Authority through the channel established by the controller or processing agent. This representative must be accredited to manage any communication, request from the owners of personal data, complaint, report, or similar that arises from administrative procedures, specifying for such purposes an email address for communications and corresponding contact.
    Article VIII. Determination of establishment
    8.1. In the case of natural persons, the establishment is understood as the premises where the main seat of their business is located or that they use for the performance of their activities or their domicile.
    8.2. Regarding legal persons, the establishment is understood as the premises where the main administration of the business is located. If it is about legal persons resident abroad, it is understood that it is the premises where the main administration of the business is located in Peruvian territory, or in default, that which they designate, or any stable installation that allows the effective or real exercise of an activity.
    8.3. If it is not possible to establish the address of the establishment or domicile, they are considered to have an unknown domicile in Peruvian territory.
    Article IX. Governing principles
    The owner of the personal data bank, or in their case, the person who is responsible for the processing of personal data, must comply with the legal regime in

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 155,370-character original (15% of the document). The remainder was not translated. The complete original-language text is stored with this document.]