Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad

Proyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on 10 January 2025

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

Proposed: draft date not recorded.

A security baseline statutes rule binding public and private bodies.

As of 17 September 2026.

What it requires

This bill does not currently bind: introduced before the Congreso de la Republica on 10 January 2025, no committee report or floor vote is described in the located commentary, and no later legislative stage is confirmed here.
If enacted as introduced, expect a duty to cooperate with public authorities on national cybersecurity matters where you operate as a private legal person in Peru, and expect the Comite de Ciberseguridad the bill creates to address you with guidelines on countering security breaches rather than a specific, clock-bound technical duty.
As introduced, the bill sets no deadline for reporting a security incident and creates no agency empowered to inspect or sanction a private institution, so it is not yet the operative cyber-incident-reporting regime for this jurisdiction; see this jurisdiction's summary for the sector-specific regime that already binds some private operators outside this vocabulary's present reach.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

The bill as introduced creates no criminal offense; Peru's existing computer-misuse offenses sit in Ley 30096 and are filed under this jurisdiction's scraping topic.

Who enforces it

Enforcement body

None: the bill as introduced creates no agency or authority with inspection or sanctioning power over the guidelines it would let the Comite de Ciberseguridad address to a private institution.

Settledness

As of: 17 September 2026
Open questions: Has Proyecto de Ley 9906/2024-CR advanced past committee, been amended to add the incident-reporting clock and sanctioning agency a comparative commentary recommends, or lapsed, since the source's own 2 October 2025 date?

What it reaches

Obligation class

Security, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Proyecto de Ley 9906/2024-CR, introduced before the Congreso de la Republica on 10 January 2025, would enact a standalone digital-security law. Its stated purpose, per the bill's own exposicion de motivos, is to strengthen information security in Peru against unlawful conduct that seeks to access, damage, or remove digital information belonging to a natural or legal person under public or private law alike.

Article 5 creates a Comite de Ciberseguridad that plans cyberattack-mitigation action lines for public institutions. Article 7 separately empowers that Comite to adopt guidelines addressed to a private institution to counter security breaches. Article 8 separately requires a public and a private entity to cooperate with each other to maintain national cybersecurity.

As introduced, the bill sets no incident-reporting clock and creates no agency with inspection or sanctioning power over a private institution's compliance, a gap a comparative commentary measures against Chile's Ley 21663 (Ley Marco de Ciberseguridad), which the same commentary names as the region's first cybersecurity framework law.

This bill does not currently bind: as of the source's own date (2 October 2025), no committee report or floor vote is described in the located commentary, and no later legislative stage is confirmed here.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics
serves_minors
operates_social_platform
ships_mobile_app
distributes_software_product

Read the law

LP Derecho, comparative-law commentary on the bill text and its exposicion de motivos

Back to the example · Lint your app