Peru: Adopted Regulation of the Personal Data Protection Law including cybersecurity requirements

On 30 November 2024, the President adopted the Regulation of the Personal Data Protection Law (Law no. 29733), which is intended to enable the adequate implementation of the Law. The Regulation sets out in detail the content of the cybersecurity obligations established by the Law, including detailing requirements for secure data processing, security and access controls, and rules for automated copying and reproduction of documents. The Regulation also refers to Peruvian technical standards based on ISO/IEC standards as possible references for a number of obligations. The majority of the Regulation enters into force 120 days after publication in the official journal, on 30 March 2025.