Peru: Closed consultation on draft Regulation of the Data Protection Law including cross-border data transfer regulation

On 24 September 2023, the Government of the Peruvian State has closed the public consultation on the draft Regulation of the Personal Data Protection Law - an implementing regulation including cross-border data transfer regulation. The Regulation aims to define new legal categories and principles for data protection, including incident reporting and impact assessments. Specifically, the Regulation includes details on the rules applicable to cross-border data transfers. The Regulation reiterates that cross-border data transfers are only permissible to third countries with adequate levels of data protection, failing which the parties to the transfers must make adequate guarantees for the protection of the personal data in question. The Regulation provides the criteria by which the national data protection authority evaluates whether a third country has adequate levels of data protection. The Regulation also establishes that adequate guarantees can take the form of standard contractual clauses or a valid code of conduct. Processors are required to notify the data protection authority of their cross-border data transfers and can additionally request an evaluation of the legality of these transfers