Peru

Article 22 classifies AI risk into two named categories, uso indebido (misuse, deemed prohibited by definition) and high-risk use, and treats every other use as acceptable risk. Article 23 deems it misuse to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter behavior.

It is also misuse to generate an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting. Carrying out mass surveillance without a legal basis or where it generates or may generate a disproportionate impact on the exercise of fundamental rights is misuse as well.

So is analyzing, classifying, or inferring a person's sensitive data from their biometric data to deduce racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation, or evaluating or classifying natural persons or groups in a way that produces discriminatory or disproportionate results violating fundamental rights.

Carrying out real-time biometric identification to categorize natural persons in public spaces is misuse too, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes. Predicting that a natural person will commit a crime based on profiling or an assessment of personality traits is likewise misuse.

Article 23.4 excepts, specifically from the real-time biometric identification prohibition, a system that supports a human evaluator's assessment of a person's involvement in an existing criminal activity, provided the assessment rests on objective, verifiable facts and the system carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination.

The Regulation applies to public-administration entities and to private-sector organizations, civil society, citizens, and academia, and enters into force ninety business days after its publication. It creates no sanctioning regime of its own for a breach of these prohibitions distinct from referring suspected violations to the competent authority.

Article 24 classifies an AI-based system's use as high-risk where, among other criteria, it manages critical national assets supporting essential services (energy, telecommunications, health, transport, water, and banking, among others) or is used to evaluate a person in a selection process. A developer or implementer may ask the SGTD to determine whether a use falls within the high-risk category.

Article 25 requires the developer or implementer of a high-risk system to establish mechanisms guaranteeing algorithmic transparency, informing the user beforehand, clearly and simply, of the system's purpose or use, its main functions, and the kind of decisions it can make, and, where the system's decisions affect human rights, to explain its results to affected users in accessible language.

For a private-sector developer or implementer, article 25's transparency duty and a related Title VI chapter phase in gradually by sector, starting the day after the Decreto Supremo's publication: one year for AI uses in health, education, justice, security, and economy-finance; two years for transport, commerce, and labor; three years for production, agriculture, energy, and mining; and four years for every other use nationwide, with a further, longer schedule for small businesses and innovative start-ups.

Public-sector entities implement article 25 on their own graduated schedule, running from one to three years after the Decreto Supremo's publication depending on the type of entity; only for the smallest local governments (Tipo D, E, F, and G) is implementing article 25 described as facultative, according to their resources and capacities.

Article 26 requires compliance with the personal-data and privacy rules in force for any high-risk system's development, implementation, or use, and states that liability for a breach of those data-protection duties is determined under Ley No. 29733's own sanctioning regime rather than under this Decreto Supremo.

The Law applies to personal data contained or destined to be contained in a personal-data bank of public or private administration whose processing takes place within Peru, and gives special protection to sensitive data; it excludes a bank a natural person creates for purposes exclusively related to their private or family life.

Processing personal data requires the titleholder's consent, which must be prior, informed, express, and unequivocal, and the titleholder may revoke it at any time under the same requirements as its grant. For sensitive data, consent must additionally be given in writing; processing without it is permitted only where a law authorizes it and the processing serves important public-interest grounds.

A cross-border transfer of personal data is permitted only where the receiving country maintains an adequate level of protection under the Law; where it does not, the sender of the transfer must instead guarantee that the processing will comply with the Law, subject to statutory exceptions including a transfer under an international treaty Peru is party to and a transfer the titleholder has consented to.

The Autoridad Nacional de Protección de Datos Personales (ANPD) enforces the Law and may impose administrative fines for its violation or that of its regulation: a minor infraction draws a fine of 0.5 to 5 Tax Units (UIT), a serious infraction more than 5 up to 50 UIT, and a very serious infraction more than 50 up to 100 UIT, in no case exceeding ten percent of the offender's gross annual income for the preceding fiscal year.

The current implementing regulation is Decreto Supremo No. 016-2024-JUS, published 30 November 2024; its own operative text is not reproduced here.

Article 12-A, incorporated into Ley 30096 by Decreto Legislativo 1700, punishes possessing, buying, receiving, marketing, selling, facilitating, exchanging, or trafficking computer data, access credentials, or personal databases, knowing or having reason to presume they were obtained without the titleholder's consent or through a security breach or the commission of a computer offense, with five to eight years' imprisonment and 180 to 365 day-fines.

The penalty rises to eight to ten years' imprisonment, with disqualification, where the agent acts as a member of a criminal organization, causes serious patrimonial harm or affects a plurality of persons, or the database is processed or held by a public entity.

Decreto Legislativo 1741 widened the article's exemption clause: conduct is exempt from criminal liability where it is carried out with the titleholder's express authorization under Ley 29733, in compliance with a lawful judicial or administrative order, in the legitimate exercise of fundamental rights or legally recognized functions, or as an activity carried out in the securities, financial, pension, or insurance sectors, provided there is no purpose of unlawful gain or improper commercialization of the information. Neither decree states a commencement date for the offense distinct from its own publication.

Article 2 punishes deliberately and illegitimately accessing all or part of a computer system, or exceeding authorized access, with one to four years' imprisonment and thirty to ninety day-fines; the penalty rises to three to six years' imprisonment and eighty to one hundred twenty day-fines where the agent defeats a security measure to gain access.

Article 3 punishes deliberately and illegitimately damaging, introducing, deleting, deteriorating, altering, suppressing, or making inaccessible computer data, and article 4 punishes deliberately and illegitimately disabling a computer system in whole or in part, impeding access to it, or hindering its operation or the provision of its services, each with three to six years' imprisonment and eighty to one hundred twenty day-fines.

Article 7 punishes deliberately and illegitimately intercepting non-public computer data transmissions to, from, or within a computer system. Article 10 punishes fabricating, designing, developing, selling, facilitating, distributing, importing, or obtaining a mechanism, program, device, password, access code, or other computer data specifically designed to commit one of the Law's offenses.

Article 11 raises the sentence by up to one-third above the legal maximum for any of these offenses where an aggravating circumstance applies, including, since Ley 32314 (29 April 2025), where the agent commits the offense using artificial intelligence or a similar or analogous technology. Article 12 exempts from criminal liability conduct described in articles 2, 3, 4, or 10 undertaken to carry out an authorized test or other authorized procedure to protect computer systems.

Article 44 permits quoting from a lawfully disclosed work without the author's consent or payment, provided the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies. The provision is a general quotation exception rather than a text-and-data-mining exception, and Peru has not enacted a distinct exception for automated extraction or analysis of a work's text or data.

This consolidated WIPO Lex text is current to Decreto Legislativo 1391 (2018), whose amendments reach other articles of the statute and not article 44; WIPO Lex flags a further consolidated version as available that is not reproduced here.

Article 5(l) protects an anthology or compilation of works or expressions of folklore, and a database, as a protected work only where the collection is original in the selection, coordination, or arrangement of its contents, so Peru confers no sui generis database right and protects a database only under ordinary copyright's originality standard.

Article 48 permits copying a published sound or audiovisual recording for exclusively personal use, but expressly excludes a database or compilation of data from that personal-use privilege.

Article 44 permits quoting from a lawfully disclosed work without the author's consent or payment, provided the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies.

Article 45(a) permits, without authorization, disseminating images or sounds of a work seen or heard in the course of a current event, by sound or audiovisual means, to the extent an informatory purpose justifies, and article 45(b) permits the press or any transmission medium to disseminate, as news of current events, speeches, lectures, addresses, sermons, and similar works delivered in public, to the extent an informatory purpose justifies and without prejudice to the authors' own right to publish those works individually.

Neither provision carries a headline-length or short-extract cap distinct from this proper-practice and informatory-purpose test, and no reported Peruvian decision applies either provision to a systematic news aggregator rather than an individual quoting or reporting a published work. This consolidated WIPO Lex text is current to Decreto Legislativo 1391 (2018), whose amendments reach other articles of the statute and not articles 44 or 45.