Peru: Implemented Regulation of the Personal Data Protection Law including data protection requirements

On 30 March 2025, the Regulation of the Personal Data Protection Law (Law no. 29733), which is intended to enable the adequate implementation of the Law, was implemented. The Regulation provides a number of definitions, sets out the conditions for valid consent, and specifies obligations in relation to processing special categories of data. The Regulation further elaborates on the scope of data subject rights. The Regulation also specifies that certain Peruvian versions of ISO/IEC standards can be referenced in carrying out data protection impact assessments. Further, the Regulation specifies the duties of the Personal Data Officer (PDO), and sets out the conditions under which a PDO must be nominated.