Ley 29733, enforcement, supervisory authority and sanctions

Article 32 makes the Ministry of Justice, through its Dirección Nacional de Justicia, the Autoridad Nacional de Protección de Datos Personales, empowers it to open offices nationwide, and gives it sanctioning power under the general administrative-procedure law and coercive power under the coercive-execution law.

Article 33 lists the Authority's functions, including representing Peru internationally on data protection, cooperating with foreign authorities, administering the Registro Nacional de Protección de Datos Personales, publishing the registry of public and private data banks, promoting protection of children's and adolescents' data, issuing technical opinions on draft rules touching personal data that are binding, resolving titleholders' claims and ordering precautionary or corrective measures, and opening investigations on its own initiative or on complaint and applying the corresponding administrative sanctions.

Article 34 creates the Registro Nacional de Protección de Datos Personales to record public and private data banks, cross-border data-flow communications, and the sanctions and precautionary or corrective measures the Authority imposes, open to public consultation as to a bank's existence, purpose, and ownership.

Article 35 binds Authority personnel to confidentiality that survives their tenure, and article 36 funds the Authority from administrative fees, fine proceeds, international technical cooperation, and legacies and donations.

Article 37 lets the sanctioning procedure open on the Authority's own initiative or on a complaint, with its resolutions exhausting the administrative channel and reviewable only through a contencioso-administrativo action; article 38 has the regulation classify infractions as minor, serious, or very serious and lets the Authority order corrective measures alongside a sanction, holding a respondent strictly liable for a breach of personal-data-protection duties.

Article 39 sets three fine tiers, a minor infraction from 0.5 to 5 Tax Units (UIT), a serious infraction from more than 5 to 50 UIT, and a very serious infraction from more than 50 to 100 UIT, with the fine never exceeding ten percent of the offender's gross annual income for the prior fiscal year, without prejudice to any disciplinary, civil, or criminal liability that separately applies; and article 40 lets the Authority impose coercive fines of up to 10 UIT for failing to comply with an accessory obligation the sanctioning procedure imposed.

Disposición complementaria final sexta keeps the constitutional habeas data process, under the Código Procesal Constitucional, independent of the Law's own administrative procedure, and states that the administrative procedure is not a precondition for pursuing the constitutional action, so the Law does not itself arm a titleholder with a private cause of action beyond its own administrative channel and that separate constitutional remedy.