Peru: Adopted Regulation of the Personal Data Protection Law including data protection requirements

On 30 November 2024, the President adopted the Regulation of the Personal Data Protection Law (Law no. 29733), which is intended to enable the adequate implementation of the Law. The Regulation provides a number of definitions, sets out the conditions for valid consent, and specifies obligations in relation to processing special categories of data. The Regulation further elaborates on the scope of data subject rights. The Regulation also specifies that certain Peruvian versions of ISO/IEC standards can be referenced in carrying out data protection impact assessments. Further, the Regulation specifies the duties of the Personal Data Officer (PDO), and sets out the conditions under which a PDO must be nominated. The majority of the Regulation enters into force 120 days after publication in the official journal, on 30 March 2025.