Peru Still Lacks a General Cybersecurity Law

Despite the Digital Trust Framework, the Personal Data Protection Law, the Computer Crime Law and sector-specific regulations, Peru still lacks a General Cybersecurity Law. El Peruano’s Jurídica supplement says that gap leaves the National Cybersecurity Strategy without legal and institutional backing, while also leaving responsibilities for authorities, essential service operators and critical infrastructure undefined.

What rules govern data protection in Peru today?

The current legal basis is Law No. 29733 on Personal Data Protection and its regulation, according to the international GDPRI / DataProtection.gi monitor. That record also says the regulation approved under Supreme Decree No. 016-2024-JUS has been in force since March 31, 2025.

At the same time, SeccioN Noticias explained that Law No. 29733 defines sensitive data as information whose disclosure could directly affect the holder’s privacy. The examples cited include biometric records, financial history, employment history and data on ethnic origin.

What penalties does local coverage mention?

SeccioN Noticias cites fines that can reach roughly S/ 275,000 for violations tied to personal data protection. That reference is linked to the same law currently in force, which remains the main framework for these obligations in the country.

Taken together, the data protection law and its 2025 regulatory update show a stronger personal data regime, while El Peruano’s reporting points to another legislative gap, the absence of a specific cybersecurity law to define institutional responsibilities and the treatment of critical assets.

Are there bills pending on these issues?

No specific bills in progress on cybersecurity or data protection in Peru were identified in the material reviewed. What does appear is a split regulatory picture, with a data regime already established and a regulation in force since March 2025, alongside a still-pending legislative gap in cybersecurity.