Peru Law 29733

Peruvian Personal Data Protection Law - principles, data subject rights, registration, cross-border transfers.


Short name	PE 29733
Region	Americas
Country or scope	Peru
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PE 29733

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for PE 29733.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for PE 29733 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`PE-29733-9` Security Principle	The controller must adopt the technical, organizational and legal measures necessary to guarantee the security of personal data and avoid its alteration or loss; verifiable integrity of the software inventory evidences this (Law 29733 Art. 9)	Scan
`PE-29733-SEC` Security of Processing Systems	Data-bank owners must implement security measures appropriate to the processing performed; assessing and patching the processing stack requires known versions for its components (Law 29733, security-of-processing obligation)	Scan
`PE-29733-REG` National Registry of Data Banks	Personal data banks must be registered in the National Registry for Personal Data Protection with identifying details; a uniquely identified, timestamped SBOM supports registration-grade documentation of processing systems (Law 29733, data-bank registration obligation)	Scan
`PE-29733-XBORDER` Cross-Border Flow Readiness	Cross-border flows of personal data require guarantees of adequate protection in the destination; establishing what is transferred and by which systems requires precisely identifiable components (Law 29733, cross-border flow provision)	Scan
`PE-29733-PROC` Processing by Service Providers	Processing entrusted to a service provider (encargado) must be governed by the controller's instructions and equivalent safeguards, which requires knowing the suppliers behind the software used in processing (Law 29733, processor obligation)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PE-Art5`	Consentimiento (Art. 5)
`PE-Art9`	Flujo Transfronterizo (Art. 9)
`PE-Art18`	Medidas de Seguridad (Art. 18)
`PE-Art19`	Derecho de Información (Art. 19)
`PE-Art20`	Derecho de Acceso (Art. 20)
`PE-Art21`	Derecho de Rectificación y Cancelación (Art. 21-22)
`PE-Art32`	Registro Nacional de Protección de Datos (Art. 32)
`PE-DS-01`	Datos Sensibles
`PE-ENC-01`	Cifrado y Control de Acceso
`PE-BR-01`	Notificación de Violaciones de Seguridad

Policy templates

Written for PE 29733:

Aviso de Privacidad / Política de Privacidad: Marco LATAM

And 22 from the standard set, adapted to PE 29733.