What Is Ley N.º 29733, Ley de Protección de Datos Personales?
Law No. 29733, Ley de Protección de Datos Personales, promulgated 2 July 2011, is Peru's primary data-protection statute, amended by Decreto Legislativo No. 1353 (published 7 January 2017), which amended Articles 2, 3, 12, 14, 15, 18, 20, 21, 22, 25, and 27 and separately changed the title and Articles 28, 31, 34, and 38. The current implementing regulation is Supreme Decree No. 016-2024-JUS, published 30 November 2024 and in force since 31 March 2025, which expressly repealed the former regulation, Supreme Decree No. 003-2013-JUS. El Peruano's consolidated text (dated current in the 9 October 2026 review) presents the law together with the current regulation; no later superseding regulation or direct statutory amendment was located. The Autoridad Nacional de Protección de Datos Personales (ANPD), operating within Peru's Ministry of Justice transparency structure, administers the statutory ARCO rights framework and a trilateral tutela complaint procedure.
At a glance
- Full name
- Ley N.º 29733, Ley de Protección de Datos Personales
- Short code
- Law 29733
- Jurisdiction
- Peru
- Enacted
- 2011
- Last major update
- Current implementing regulation Supreme Decree No. 016-2024-JUS in force 31 March 2025, repealing the former Supreme Decree No. 003-2013-JUS; statute amended by Decreto Legislativo No. 1353 (2017)
- Regulator
- Autoridad Nacional de Protección de Datos Personales (ANPD)
- Private right of action
- Yes
- Statutory citation
- Ley N.º 29733, Ley de Protección de Datos Personales
Scope, who Law 29733 covers
Protected data
Data subject rights
Information: notice of collection, purpose, recipients, database, controller identity, mandatory vs. optional nature, transfers, retention, and exercise mechanisms
Access
Rectification
Update and inclusion
Cancellation/suppression, when data are no longer necessary, the retention period has expired, consent is revoked, or processing is unlawful
Opposition, for founded, legitimate reasons tied to the person's concrete situation
Objective treatment: protection against solely automated decisions with legal or significant effects, subject to contractual and public-sector exceptions
Prevention of supply
Indemnification and tutela: compensation and an ANPD or court complaint route
Portability, treated by the current regulation as a manifestation of the access right for consent- or contract-based automated processing
Notable features
Peru's ARCO framework (Access, Rectification, Cancellation, Opposition) is the region's standard rights vocabulary, distinct from GDPR's rights terminology though functionally similar. The direct-request procedure has firm statutory deadlines (Information 8 days, Access 20 days, Rectification/cancellation/opposition 10 days), while the ANPD tutela procedure's own filing deadline for initiating a complaint after a denied or unanswered request was not located in the current regulation — a genuine gap between the two procedural tracks.
Enforcement & penalties
Regulator: Autoridad Nacional de Protección de Datos Personales (ANPD)
Penalties: Three-tier UIT-based structure under Law No. 29733 Articles 39-40: minor violations 0.5-5 UIT; serious violations >5-50 UIT; very serious violations >50-100 UIT; plus a coercive fine of up to 10 UIT for accessory-obligation noncompliance. No fine may exceed 10% of the offender's prior-year gross annual income. Using the 2026 UIT value of S/ 5,500 from the official SUNAT table, these ranges are approximately S/ 2,750-27,500 (minor), S/ 27,500-275,000 (serious), and S/ 275,000-550,000 (very serious) — indexed arithmetic, not guaranteed case-specific payable amounts.
Private right of action: The ARCO framework includes a right to "indemnification and tutela": compensation and a complaint route through the ANPD's trilateral tutela procedure or the courts, including a judicial habeas data action under Article 24. The tutela procedure has stage-specific deadlines (15-day respondent answer, 30-day ANPD resolution extendable by up to 30 more days for complexity), but no standalone deadline for initiating the tutela procedure itself was located in the regulation.
Relevance to data brokers
No Peru-specific data-broker, people-search-service, or public-record-aggregator complaint/deletion route has been located. An ANPD tutela case against Click Derecho S.A.C. concerning cancellation/opposition used the ordinary ARCO tutela route rather than a special broker procedure, illustrating that a broker in Peru is treated as an ordinary controller subject to the general ARCO framework rather than a distinct regulated category.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What are ARCO rights in Peru?+
ARCO stands for Acceso (access), Rectificación (rectification), Cancelación (cancellation/suppression), and Oposición (opposition) — Peru's core statutory data-subject rights under Law No. 29733, supplemented by a portability right, information rights, and protection against solely automated decisions.
How long does a company have to respond to an ARCO request in Peru?+
The current regulation sets direct-request deadlines of 8 days for information requests, 20 days for access requests, and 10 days for rectification, cancellation, or opposition requests, running from the day after submission.
What happens if a company denies or ignores my ARCO request?+
You can escalate to the ANPD's trilateral tutela procedure: the respondent gets 15 days to answer, and the ANPD generally resolves within 30 days of that response (extendable by up to 30 more days for complexity), with an appeal to the Dirección General de Transparencia as the final administrative instance. No standalone deadline for initiating this tutela procedure itself was located in the current regulation.
Official sources & citations
- Ley N.º 29733 (official Congress law record)
- Supreme Decree No. 016-2024-JUS (current implementing regulation)
- ANPD notice: new data-protection regulation in force 31 March 2025
- SUNAT: 2026 UIT value
- Decreto Legislativo No. 1353 (2017 statutory amendment)
- El Peruano consolidated text of Law 29733 + current regulation
- ANPD decision: Exp. 131-2024-PTT, Click Derecho S.A.C.
Other international privacy regimes
Law 29733 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: