• Inicio
  • Nuestro estudio
  • Nuestro equipo
  • Áreas
  • Migrar al Perú
  • Vídeos
  • Blog
  • Contacto
  • Inicio
  • Nuestro estudio
  • Nuestro equipo
  • Áreas
  • Migrar al Perú
  • Vídeos
  • Blog
  • Contacto
  • Inicio
  • Data Privacy in Peru: Rules of Mandatory Compliance for Companies Which Store Private Data

Data Privacy in Peru: Rules of Mandatory Compliance for Companies Which Store Private Data

Data Privacy in Peru: Rules of Mandatory Compliance for Companies Which Store Private Data

03
Sep / 2017
Por: RGB Avocats – Corporate Lawyers in Peru

Not all foreign investors are aware that Peru has a law for the protection of private data, which imposes some obligations upon companies in regard how data is processed and treated. This article is meant to introduce the reader into the basics of the Peruvian Law for the Protection of Private Data – Law N° 29733 (hereinafter the “Law”).

What is Private Data?

The Law distinguishes two classes of Private Data: Personal Data and Sensitive Data. The first is defined as “all information of a natural person which will help identify them, through methods reasonably used”. Personal Data includes information such as numbers, letters, graphics, photos and acoustic files. In other words names, address, ID number, photos, and voice recordings, among others.

Sensitive Data is information relative to the person’s physical, moral or emotional characteristics. It includes information such as race or ethnicity, income, political or religious opinions, convictions union membership, and information relative to physical, mental and sex life.

Thus, when a company is collecting and storing data from their clients they may inadvertently be collecting Personal and Sensitive Data, thus becoming a holder of a Personal Information Database subject to the obligations imposed by the Law.

What obligations are imposed upon companies by the Law?

  1. Consent: The first thing to keep in mind is that, before you collect any Personal or Sensitive Data from a person you must obtain their prior consent. In the case of Sensitive Data, this prior consent must be in writing.Likewise, the people whose data is being collected must be informed precisely what their data will be used for, who will have access to the data and the existence of the database where their information will be stored as well the name and address of the person in charge of such.

  2. Registration: on the other hand, when a company collects and stores Private Data, by any means, it becomes a holder of a Personal Information Database, in accordance with the Law. Thus the company is required to register said database with the Peruvian General Direction for the Protection of Private Data (hereinafter the “DPPD”), by filling out the forms provided by the DPPD. Personal Information Databases vary according to (i) the type of information they store, (ii) the means of collecting the data and (iii) the support used to store the data. Thus a single company can, at any given time, be in control of several databases. Companies in possession of more than one database must register each one, in order to be in compliance with the law.

  3. Access: the Law grants the right to the person whose data is being collected to (i) revoke his consent at any given time for the storage of their private data, (ii) access their personal information that is being stored by the company, (iii) ask the holder of the database to rectify any mistakes regarding their personal information, (iv) have the information cancelled/deleted from the database.

  4. Protection: holders of Personal Information Databases are required to guard and protect such information from people who have not been authorized, by the person who gave out the data, to treat or use their private data. Thus, companies who collect and store private data must be sure to restrict the access to the database, in accordance with the guidelines established by the DPPD, depending on the type of private data being stored and the amount of people to whom it belongs.

  5. Communication of cross-border flow of data: the holder of a Personal Information Database must communicate the DPPD the transference or flow of private data to sources located outside of Peruvian territory.

What are the exceptions to these obligations?

Notwithstanding the aforementioned, the person or entity collecting Private Data will not require consent in the following circumstances:

  1. When the treatment of Private Data is carried out by natural persons, for exclusively domestic or personal purposes, related to their private or family life;

  2. When the contents of the Personal Information Database will be stored in a database open to the public.

  3. When the information being collected and stored is Personal Data relative to the financial and credit history of the person, in accordance with the Law;

  4. When the data is collected in the context of a law promoting competition in regulated markets, so long as the information is not used in detriment of the user’s privacy;

  5. When the Personal Data is necessary for the execution of a contract of which the owner of the data is a party to, or when the Personal Data derives from a scientific or professional relation and are necessary for its development or fulfillment;

  6. When the Personal Data is related to health and its necessary, in circumstances of risk, for the prevention, diagnosis and medical or surgical treatment of the owner;

  7. When the treatment of the data is carried out by non-profit organizations whose purpose may be political, religious or related to unions, and the collection is carried out in the context of their activities;

  8. When the treatment of the Personal Data is necessary to safeguard the interests of the owner of said data.

What are the legal consequences of not complying with the Law?

It should be noted that the Law is currently being applied by the DPPD, and companies not found in compliance can face fines between PEN 84.00 (approximately USD 25.00) and PEN 42,000.00 (approximately USD 12,500.00). Thus, it is in the best interest of investors to be mindful of the Law, when collecting and storing private data.

Compartir
Regresar

Últimos posts

Guidance for inheritance in Peru

Enero 25, 2017

El consorcio en las contrataciones con el Estado en el Perú

Enero 27, 2017

Legal Issues When Buying Property in Peru

Enero 28, 2017

Obtaining a Rentista Visa in Peru

Enero 29, 2017

Being Hired as a Foreign Worker by a Peruvian Employer

Enero 30, 2017

La tributación en el Perú de la asistencia técnica en los contratos internacionales

Enero 30, 2017

Tax on Real Estate Transactions in Peru

Febrero 01, 2017

Leaving Peru and Income Tax

Febrero 02, 2017

Tax Residency in Peru for Foreigners

Febrero 03, 2017

Personal Income Tax in Peru

Febrero 04, 2017

Corporate Tax in Peru

Febrero 05, 2017

Why Set Up a Closed Corporation in Peru?

Febrero 06, 2017

The New Immigration Law in Peru

Febrero 17, 2017

La nouvelle loi d’immigration au Pérou

Febrero 17, 2017

Renting Property in Peru

Marzo 17, 2017

Immigration au Pérou : entrée en vigueur d’une nouvelle loi et de son règlement d’application

Abril 18, 2017

Buying Real Estate at Blueprint Stage in Peru

Abril 21, 2017

Agosto 17, 2018

Recomendaciones relativas a deducibilidad de los gastos por servicios intra-grupo

Agosto 17, 2018

Opening a Business in Peru

Diciembre 23, 2019

Turistas que exceden 183 días en el Perú: ¡Cuidado!

Enero 29, 2020

Nuevas medidas laborales en el marco de la emergencia nacional COVID-2019

Marzo 30, 2020

Guidelines for resuming economic activities in Peru during COVID-19

Mayo 14, 2020

Contratos de Estado a Estado en el Perú - RGB Avocats asesora en contratos GtoG

Agosto 09, 2020

Comentarios al reglamento de registro de sociedades acerca de la inscripción de poderes otorgados por sociedades constituidas en el extranjero

Septiembre 12, 2021

What happens with the corporate name of a Peruvian branch (sucursal) if the corporate name of its foreing parent company is amended?

Septiembre 20, 2022

What are the main obligations of a foreign worker holding a carne de extranjeria in Peru?

octubre 04, 2022

What should be the main components of an Anti-Corruption Compliance Program in Peru?

octubre 12, 2022

Recent Type of Companies Regulated in Peru

octubre 20, 2022

GTOG CONTRACTS IN PERU

octubre 27, 2022

RGB Avocats es un estudio de abogados, domiciliado en Lima, Perú, que asesora al inversionista para que asegure el éxito de sus inversiones en el territorio peruano.

Mapa Web

  • Inicio
  • Nuestro estudio
  • Nuestro equipo
  • Áreas
  • Migrar al Perú
  • Vídeos
  • Blog
  • Contacto

Datos de contacto

  • Centro Empresarial “Blu Building” Calle Los Tulipanes 147, Of. 303, Urb. Polo and Hunt Club Santiago de Surco, Lima 33 – Perú
  • Llámanos

    +51-1 437 6634

  • WhatsApp

    +51 993 455 192

  • Escríbenos

    rgb@rgbavocats.com

© 2019 Todos los derechos reservados RGB Avocats

Desarrollado por: Soluciones Ajax