Ley 29733, cross-border transfer of personal data

Ley No. 29733, arts. 11, 15 (cross-border transfer)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 3 July 2011.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before a cross-border transfer of personal data, confirm the destination country maintains an adequate level of protection under the Law, or, where it does not, guarantee as the sender that the processing will comply with the Law.
Treat the adequate-protection requirement as met without a separate guarantee where the transfer falls under an international treaty Peru is party to, international judicial or anti-crime intelligence cooperation, performance of a contract the titleholder is party to, a banking or securities transaction, a medical or epidemiological purpose using dissociation, or the titleholder's prior, informed, express and unequivocal consent.
Assess a cross-border transfer against a level of protection at least equivalent to this Law's own principles and to security and confidentiality measures appropriate to the data's category.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 11 states the guiding principle that a cross-border transfer of personal data must guarantee a sufficient level of protection for the data to be processed, or, at minimum, a level comparable to what this Law or applicable international standards provide.

Article 15 operationalizes that principle: the titleholder and the processor of a cross-border data flow may carry it out only where the destination country maintains an adequate level of protection under the Law; where it does not, the sender of the transfer must instead guarantee the processing will comply with the Law.

That second requirement does not apply to eight listed cases: a transfer under an international treaty Peru is party to; international judicial cooperation; international cooperation between intelligence agencies against terrorism, drug trafficking, money laundering, corruption, human trafficking, or other organized crime; a transfer necessary to perform a contract the titleholder is party to, including user authentication, service improvement and support, quality monitoring, and account maintenance and billing support; a banking or securities transfer, for the respective transactions and under applicable law; a transfer for the titleholder's medical or surgical prevention, diagnosis, or treatment, or for an epidemiological or similar study using an adequate dissociation procedure; the titleholder's prior, informed, express, and unequivocal consent; and any other case the Law's regulation establishes, subject to article 12.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

consolidated text of Ley 29733
Ley de Protección de Datos Personales, as republished by LP Derecho (Pasión por el Derecho), a Peruvian legal publisher

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app