Peru’s new data protection regulation: what changes for your website and campaigns
The regulation of Peru’s Law 29733 has been in force since March 2025. What it means for forms, databases, campaigns and the data protection officer.
GrowLab3 min read
If your company captures leads through forms, keeps customers in a CRM or runs remarketing, data protection is no longer just a legal-department issue. Since March 30, 2025, Peru has a new regulation for Law No. 29733, approved by Supreme Decree 016-2024-JUS, which replaced the 2013 regulation.
This article summarizes what matters most for digital marketing. It is not legal advice: for your specific case, check with a specialized lawyer.
What the rule is and when it took effect
- Rule: Supreme Decree 016-2024-JUS, published in El Peruano on November 30, 2024.
- In force: 120 days after publication, that is, from March 30, 2025.
- Some obligations have their own deadlines, such as the right to data portability (from September 30, 2025) and the data protection officer (phased in by company size).
The changes that most affect marketing
1. It also applies to foreign companies selling in Peru
The regulation covers organizations outside the country that, for example, offer goods or services to people in Peru or analyze their behavior. Those companies must appoint a representative.
2. Transparency and accountability
Transparency and proactive accountability become principles: complying is not enough, you must be able to prove you comply. In practice, that means documenting what data you collect, what for, and who has access to it.
3. Security incidents: 48 hours to report
If there is a breach (for example, a leak of your lead database), it must be reported to the National Authority for Personal Data Protection within 48 hours of detecting it. In addition, the security document must be formally approved and include an inventory of the data and systems you use.
4. Data protection officer, with deadlines based on sales
Private companies that process large volumes of data, affect many people or handle sensitive data must appoint a data protection officer. Deadlines depend on annual sales (UIT is Peru’s tax unit):
| Size (annual sales) | Deadline to appoint one |
|---|---|
| Over 2,300 UIT | November 30, 2025 |
| Over 1,700 and up to 2,300 UIT | November 30, 2026 |
| Over 150 and up to 1,700 UIT | November 30, 2027 |
| Up to 150 UIT | November 30, 2028 |
5. A new right to data portability
People can request their data in a format that lets them take it to another provider. This applies from September 30, 2025.
6. A digital channel for complaints
The “Yo cuido mis datos personales” (“I protect my personal data”) platform lets anyone file claims and complaints. In other words: complaining will be easier for your users.
What to review on your website and campaigns
- Forms: a consent checkbox that is unticked by default, clear wording about what you will use the data for, and a link to your privacy policy.
- Privacy policy: it should state who is responsible, what data you collect, for what purpose, who you share it with (including tools such as your CRM or email platform) and how to exercise rights.
- Lead and customer database: know where it is, who has access and how long you have kept each record.
- Third-party tools: pixels, CRMs and email marketing platforms process data on your behalf; review their terms and where they store information.
- Incident plan: who detects, who decides and who reports within 48 hours.
In summary
The new regulation does not stop you from doing data-driven marketing, but it requires doing it in an organized and provable way. The good news is that well-implemented measurement (clear consent, minimal data and properly configured tools) also gives you better data to optimize your campaigns.
Sources: Supreme Decree 016-2024-JUS on gob.pe · Cuatrecasas: New Regulation of the Personal Data Protection Law · CMS: New personal data protection regulation
#data protection#Law 29733#forms#compliance
