The main players in the Peruvian telecommunications market are:

• Telefónica del Perú: provides mobile, fixed broadband, Pay TV broadcast services, and fixed telephony.
• Claro Perú (America Móvil): provides mobile, fixed broadband, Pay TV broadcast services, and fixed telephony.
• Integratel (Integra Capital): provides mobile, fixed broadband, Pay TV broadcast services and fixed telephony.
• Entel Perú (Empresa Nacional de Telecomunicaciones Perú): provides mobile and fixed broadband.
• Bitel (Viettel Group): provides mobile and fixed broadband.
• WIN (Wi-Net Telecom):  provides fixed broadband and fixed telephony.
• WOW Perú: provides fixed broadband.
• Starlink Perú: provides low Earth orbit satellite broadband services.

According to the Telecom Financial Performance Analysis conducted by the Supervisory Agency for Private Investment in Telecommunications (Organismo Supervisor de Inversión Privada en Telecomunicaciones) ("OSIPTEL"), the latest market shares by services (Jan-Jun 2025) are as follows:

• Mobile services: 50.8% 
• Equipment, sales and rent: 16.7% 
• Fixed internet: 16.1% 
• Pay TV Services: 5.5% 
• Data transmission and circuit rental: 5.0% 
• All other services (Interconnection, fixed-line subscriber telephony, long distance telephony, public use telephony and others): 5.9% 

Key operators: Claro Perú (America Móvil), Integratel (Integra Capital) and Entel Perú (Empresa Nacional de Telecomunicaciones), according to the following detail (Jan-Jun 2025):

• Claro Perú: 33.9% 
• Integratel (Integra Capital): 27.3% 
• Entel Perú (Empresa Nacional de Telecomunicaciones): 18.8% 

Telecoms overview: According to the available last report (Feb 2025), fixed broadband reached 4,069,739 subscribers, and 5.1 million subscribers are expected for 2026 (58.4% Household Penetration). In addition, fiber optic connections stand at 3,005,235 (the average annual growth since 2019 is 73.84%). In 2024, 73.84% of connections were fiber optic, while 22.72% were coaxial cable.

As of December 2024, 4G represented approximately 83.54% and 5G 1.38% of mobile connections in Peru. 5G growth is mainly limited by the infrastructure that is still being deployed.

Peru’s current ICT industry sector is driven mostly by efforts to promote 5G, implement AI technology, expand its fiber-optic infrastructure, and improve rural connectivity. In 2021, the Ministry of Transport and Communications ("MTC") authorized the initial deployment of 5G technology in Lima City and 6 other provinces (Ica, Trujillo, Arequipa, Cañete, Huarochiri and Callao). Since then, 5G technology has been gradually introduced into the Peruvian telecommunications market. In 2025, 5G deployment in Peru continues to progress gradually across the country. Nevertheless, it is still considered to be in its initial phase, with limited coverage primarily due to infrastructure and spectrum allocation. 

AI adoption is reshaping the industry through automated network management, predictive analytics, and enhanced customer services. In Peru, regulatory efforts began with the enactment of Law No. 31814, which promotes the use of artificial intelligence for the country’s economic and social development and the recent Implementing Regulation (approved by Supreme Decree No. 115-2025-PCM in September 2025). Such an Implementing Regulation establishes specific provisions for developers and implementers of AI systems. 
In addition, IoT adoption is gaining traction, particularly in agriculture, urban planning and mining. Moreover, satellite services are being used to close connectivity gaps in rural areas, and infrastructure investment continues to focus on expanding national fiber optic infrastructure.

The main laws governing telecommunications are the following:

• Supreme Decree N°. 013-93-TCC: establishes the regulation and core legal framework of Peru’s Telecommunications Law. It defines telecommunication services, concessions, licenses, and basic principles. 
• Supreme Decree N° 020-2007-MTC (Telecommunications Law Implementing Regulation).
• Law N°.29022 “Law to Promote the Installation of Telecommunications Infrastructure”: establishes a special regime throughout the national territory for the installation and expansion of public telecommunication services.
• Supreme Decree N.°003-2015-MTC: approves the Implementing Regulation of Law N° 29022. 

The authority that regulates the telecommunications sector is the Ministry of Transport and Communications ("MTC"). The MTC is responsible for granting concessions, managing spectrum, setting policies and supervising projects, among others.

In addition, the Supervisory Agency for Private Investment in Telecommunications ("OSIPTEL") is responsible for protecting users, supervising operators and issuing binding regulations.  

Pursuant to Supreme Decree No. 013-93-TCC, the following licensing requirements are applicable:

• Internet Access: The provision of internet access services requires a Single Concession (Concesión Única) granted by the MTC.
• Data Transmission: Such services require a Single Concession when provided to the public. However, in the cases where the service is intended for private or corporate use, an “Authorization for Private Telecommunications Services” issued by the MTC is required. 
• Mobile Telephony: The provision of mobile telephony services requires a Single Concession, along with the assignment of radio spectrum by the MTC, either through direct allocation or public bidding processes. 
• Mobile Virtual Network Operator ("MVNO"): MVNOs are required to obtain a Single Concession and must enter into an access agreement with a host mobile network operator ("MNO").
• Pay TV Services: The provision of Pay TV services also requires a Single Concession granted by the MTC.

In addition, for the provision of Value-Added Services, no prior authorization is required. However, providers must register before the MTC, in accordance with the applicable administrative procedures.

There are no restrictions on foreign ownership. In addition, only legal entities duly incorporated and existing under Peruvian laws may hold concessions for public telecommunications services.

It is important to mention that Legislative Decree N° 662, which grants a legal stability regime for foreign investments, aims to remove obstacles and restrictions to foreign investment in order to guarantee equal rights and obligations for both foreign and local investors.

Nevertheless, regarding broadcasting services (which are governed by a separate legal framework), majority Peruvian ownership is required to hold broadcasting licenses. These restrictions, however, do not apply to telecommunication operators. 

In Peru, telecommunications service prices are generally freely determined in a competitive market. However, the regulator ("OSIPTEL") may impose price regulation in cases where there is insufficient competition or when a provider holds significant market power in a specific service or geographic area.

Yes, according to the telecommunications regulation in Peru, regulatory approval is required for the transfer of a telecom license or when a corporate control change occurs as a result of a corporate reorganization. The MTC’s Directorate is responsible for handling modifications, renewals, cancellations and transfers of telecommunications concessions, which can only be authorized through a Vice-Ministerial Resolution.

In this sense,  the license transfer must be previously authorized by the MTC; the transferor must be fully compliant with all financial and regulatory obligations before the request is accepted. The acquiring party must meet the same legal, financial, technical and corporate requirements as a new license applicant. The MTC has 30 working days to evaluate the request. If no decision is issued within that period, the application is deemed denied.

According to the principle of equitable service, the integration of remote areas, rural areas, and areas of social interest is promoted through universal access. Universal access is defined as access throughout the national territory to a set of essential public telecommunications services. In this sense, the Peruvian State promotes and finances universal access through the Telecommunications Investment Fund ("FITEL"). Telecommunications Service Providers must contribute 1% of their gross revenue to FITEL.

Peru’s telecommunications regulatory framework establishes interconnection and access obligations for providers of public telecommunications services. Operators are required to allow other licensed providers to interconnect their networks to ensure end-to-end service interoperability. Additionally, they must provide access to their passive infrastructure, network facilities, and essential services under non-discriminatory, transparent and cost-oriented conditions. OSIPTEL is responsible for ensuring compliance with interconnection agreements and for ensuring fair competition in the market.

On the other hand, ISPs must respect the principle of neutrality, according to which operators cannot arbitrarily block, interfere with, restrict or degrade traffic, protocols, services or applications, regardless of their origin, destination or nature. With respect to the measures permitted by the net neutrality regulation, it is important to mention the measures issued by judicial orders and those adopted in emergency situations (protection against malicious actions and traffic management in the event of an interruption).

The radio spectrum is a public resource managed by the MTC. The management is based on the National Frequency Allocation Plan that assigns and distributes the frequencies for the different services, seeking the efficient use of the spectrum to promote connectivity. The concessions, as well as the corresponding spectrum allocation, are granted upon request or through a public bidding process. In addition, the MTC may consider special mechanisms for granting concessions with radio spectrum allocation. Regarding high-demand mobile frequencies, these are usually assigned through a public bidding process.

Yes, telecommunications infrastructure in Peru requires both national and local permits. At the national level, the MTC is responsible for granting licenses, managing the radio spectrum and interconnections. At the local level, authorizations are required for building permits, zoning, rights-of-way authorizations, project approvals, and special permits when the infrastructure affects protected areas.

The main regulations that apply to the deployment and sharing of passive telecommunications infrastructure are:

• Law N°29022 – Law for the Expansion of Telecommunications Infrastructure: It establishes a special regime for the installation and expansion of passive infrastructure necessary for public telecommunications services. 
• Supreme Decree N.°003-2015-MTC: approves the Implementing Regulation of Law N°.29022, establishing detailed procedures and technical standards for the regulation of passive infrastructure and deployment of telecommunications networks.
• Supreme Decree N° 023-2024-MTC: approves the Environmental Management Regulation for the Communications Sector.

Yes, the landing and operation of submarine cables require authorization granted by the MTC. In addition, other relevant authorizations would be necessary, such as regulatory permits before OSIPTEL, the National Environmental Certification Service for Sustainable Investments ("SENASE"), and the Coast Guard Authority (which would depend on the type of project to be displayed). 

Providers of satellite services must be registered with the Satellite Capacity Provider Registry, managed by the MTC. Supreme Decree N° 022-2005-MTC approves the Regulation governing the provision of satellite capacity through geostationary satellites to holders of concessions and authorizations for telecommunications services operating in Peru.

To proceed with the corresponding registration, the provider must have obtained the registration before the Andean Community of Nations (Andean Satellite List). The registration is valid for fifteen years and may be renewed. The registration holder is obliged to keep the information updated in the Registry.

Among the various legal obligations, the provider must provide response to the requests for information conducted by the MTC related to the provision of satellite capacity to holders of telecommunications service concessions and/or authorizations operating in Peru, and submit the agreements entered into with holders of telecommunications service concessions and/or authorizations operating in Peru, within a period that cannot exceed ten days (from the date of execution of such agreements). 

Yes, ground stations need to obtain the corresponding authorization before the MTC. It is important to mention that private teleservices provided by the State may directly access circuits via satellites by using space segments, and must request authorization from the Management Directorate for the use of the territorial segment. 

Direct-to-device satellite communications are not yet fully regulated in Peru. Recently, the MTC has performed the first test of the D2C satellite connectivity service. Such a test was conducted in the Quilca desert, in the province of Camaná (Arequipa region), an area lacking traditional mobile coverage. 

Yes, telecommunication equipment and devices must obtain the corresponding homologation certificate before the MTC. Equipment that does not emit radio signals or emits below 10mW PIRE is exempt from homologation. Such a homologation certificate is granted per brand and model of the equipment.

The process is performed through the Foreign Trade Single Platform ("VUCE"), where importers or manufacturers must submit the application, including technical documentation. The MTC maintains on its official website a list of telecommunications equipment that has been duly homologated. This allows importers and manufacturers to verify whether a specific product has already been certified.

Peru’s audiovisual market is undergoing a digital transition, considering a significant shift in audience preferences from traditional broadcasting towards Pay TV and OTT platforms. FTA television remains the most widely consumed audiovisual medium. The leading FTA broadcasters include América TV (Compañía peruana de radiodifusión S.A.), ATV (Andina de Radiodifusión S.A.), Latina (Compañía latinoamericana de radiodifusión S.A.), Panamericana (Panamericana Televisión S.A.) and TV Perú (Instituto Nacional de Radio y Televisión del Perú). According to the OSIPTEL report, in 2024, 1.58 million Pay TV connections were reached.

With respect to the radio market, some of the most influential players are RPP (GRUPORPP S.A.C., CRP (CRP Medios y Entretenimientos S.A.C.) and Panamericana de Radios (Grupo Panamericana de Radios S.A.).

Currently, OTT platforms are being examined by the regulatory authority. In October 2024, OSIPTEL launched an early consultation on the operation of OTT services to review the need to regulate such platforms. The initiative was conducted to count on more elements to perform a regulatory review regarding the main issues related to the lack of specific regulation. 

The provision of broadcasting services in Peru is governed by the Law N°28278 – Law on Radio and Television, and its Implementing Regulation (approved by Supreme Decree N° 005-2005-MTC) that establishes, among others, radio & television broadcasting content principles and obligations, licenses and technical standards.

The authority that regulates this sector is the MTC, responsible for granting broadcast permits and overseeing compliance with applicable obligations.

The access to broadcasting services is ruled by the following principles:

• free competition whereby monopolies and direct or indirect exclusivities are prohibited to the State or the private sector;
• free access to equal opportunities and nondiscrimination;
• authorizations must be duly motivated by rulings in force;
• efficient use of the spectrum; and
• non-discrimination conditioned on the use of certain technology.

To provide broadcasting services in any of its modalities, the interested party must first obtain the corresponding authorization granted by the MTC. This authorization is valid for a period of 10 years and is automatically renewable for successive terms, provided the holder complies with the requirements established by law. In addition, a permit is required for the installation of any transmission equipment used by the broadcasting station.

The authorizations of broadcasting services are granted at the request of a party or by public bid; this second option is carried out on a mandatory basis when the quantity of frequencies or available channels in a band is less than the number of requests filed, and its management is conducted by the MTC, under the supervision of the Broadcasting Advisory Council.

Available licenses include commercial, educational and community broadcasting. In cases where frequencies are scarce or the locality is saturated, the concession may be awarded temporarily by a special regime.

The Directorate of Management administers and updates the National Frequency Registry of authorized broadcasting services. 

The rights granted for the provision of broadcasting services (by an authorization) may be transferred with the prior approval of the MTC, provided that at least 2 years have passed since the authorization entered into force and none of the cases for refusal have occurred. The MTC has up to 90 days to issue a decision for the share transfer. 

According to the applicable regulation, the authorizations and licenses can only be granted to natural persons with Peruvian nationality or legal entities incorporated and domiciled in Peru. No foreign national may hold, either directly or through a sole proprietorship, an authorization or license.

Law on Radio and Television establishes that radio and television broadcasting may not be subject to exclusivity, monopoly or hoarding by the State or Private Entities. According to the mentioned regulation, “hoarding” shall be understood as the situation in which a natural person or legal entity holds more than 30% of the technically available frequencies (assigned or not) in the same frequency band within a single location, or more than 20% for radio broadcasting.

The MTC is responsible for granting the corresponding authorizations and licenses necessary to provide broadcasting services.

In addition, the National Registry of Cinematography and Audiovisual ("RENCA") is managed by the Ministry of Culture and functions as a mechanism to recognize natural persons and legal entities engaged in cinematographic and audiovisual activities, together with their related contracts, projects, exhibition venues or spaces and related activities.

Yes, holders of broadcasting service licenses must ensure a minimum national production equivalent to 30% of their programming, on a weekly average, during the time slot between 5:00 and 24:00 hours. 

In addition, the State may reserve at least one television channel and one radio frequency in each band for allocation to natural persons or legal entities established in the region. In such cases, the license holder´s programming proposal must focus mainly on promoting and disseminating the customs and cultural values of the respective department or region. Moreover, educational and community broadcasting services, as well as those whose stations are located in border, rural or socially prioritized areas, are granted preferential treatment.

Pursuant to the Law on Radio and Television, the time period between 06:00 am and 10:00 pm is considered “family hour”. Programming broadcast during such time slot must avoid violent, obscene or other types of content that may affect the values inherent to the family, children and adolescents.  

Holders of broadcasting service licenses must ensure a minimum national production equivalent to 30% of their programming, on a weekly average, during the time slot between 5:00 and 24:00 hours.  

According to the Telecommunications regulation, the cable television distribution service provider is obliged to include in its channel lineup the signal of the holder of an authorization to provide the TV broadcasting service operating in its respective districts, provinces, and departments, provided that the latter offers its programming available to the concessionaire free of charge, in accordance with some conditions: (i) the holder of the authorization must notify the concessionaire of its request to include its signal in the concessionaire’s lineup; (ii) the holder of the authorization must be duly authorized to provide such service in the area here the concessionaire has a television signal reception, processing and distribution center belonging to itrs network; and (iii) the interconnection costs between the infrastructures of the concessionaire and the holder of the authorization shall be borne by the latter (unless otherwise agreed). Such dispositions do not oblige the concessionaire to deploy additional infrastructure if required. In addition, the concessionaire shall assign the channel that was granted at the time of the authorization, and the transmission carried out by the concessionaire shall be performed without alterations and with the same characteristics and technology as the original signal.

The holders of the broadcasting services are responsible for classifying programming, commercial advertising, and deciding on their dissemination (considering the established time slots).

Advertising must, in general, include the following:

• Truthful and clear information
• Transparency 
• Verifiable objective claims (all factual statements must be supported by prior evidence of their truthfulness before the advertisement is disseminated).
• Compliance with the applicable regulation.
• Fair competition (advertising should highlight the advantages or benefits of the offering without denigrating competitors’ products or services).

Moreover, commercial advertising of goods and services is also ruled by the Repression of Unfair Competition Law, Legislative Decree No.1044 and Law 29571, which regulates the protection of consumers. It is intended to protect them from asymmetrical information before the advertisement. These standards will be applied in any sector or economic activity; it does not matter if the recipient of the message is a final consumer, a broker, or a goods and services supplier.

The rules protect advertising's commercial value as a mechanism of information and as an element that allows for smooth market functioning. Publicity allows entrepreneurs to exercise their right to free speech and is a vehicle for private initiative. Advertising is legal as long as it does not involve acts of unfair competition.

According to advertising regulation, the dissemination of advertising that has the effect of (i) inducing the recipients of the advertising to commit an illegal act or an act of discrimination or offense based on origin, race, sex, language, religion, opinion, economic condition or any other reason; or (ii) promoting adult content services to an audience other than adults, is considered an act against the principle of social appropriateness.
Moreover, restrictions on children apply to the dissemination of advertising (for some special categories such as the commercialization of alcoholic beverages and tobacco). Restrictions also may apply for other categories, such as advertising of regulated products -for example, medicines. 

Furthermore, Law 29571 regulates advertisements aimed at minors, establishing that this kind of publicity should not mislead minors to wrong conclusions on a particular product, and must not cause them feelings of inferiority that could lead them to consume no less than the offered product.

Broadcasters should be registered before the MTC. No additional registry is applicable.

It is important to mention that the only agency responsible for verifying compliance with the rules of advertising is the Commission on Control of Unfair Competition ("INDECOPI"). There is no other state agency able to apply sanctions in advertising; therefore, it is necessary to report the violation of the advertising rules to the Commission. Any sanction ordered by a state agency that violates this provision is void.

The administrative proceedings before the Commission are ruled by the Repression of Unfair Competition Law. Proceedings are the same as for Unfair Competition.

The general taxes, which are (i) Value Added Tax (VAT) (18%), and (ii) for the service provider, the income tax (29.5% on its net income), are applicable. In addition, the collection of the 18% VAT has been formalized for digital services provided by non-resident suppliers to end users that consume the service in the country.

Currently, there is no specific regulation for OTT platforms. However, general cross-sector regulations may apply.

OTT platforms are being examined by the regulatory authority, and in October 2024, OSIPTEL launched an early consultation on the operation of OTT services to review the need to regulate such platforms. This process aims to identify potential gaps in supervision and to determine if new rules could be introduced.
Moreover, the collection of the 18% VAT has been formalized for digital services provided by non-resident suppliers to end users that consume the service in the country.

Yes, Peru has a regulation on Artificial Intelligence, and it is important to note that its Implementing Regulation was recently approved in September 2025:

• Law N° 31814 ("AI Law"): Law that promotes the use of Artificial Intelligence for the country´s economic and social development. 
• Supreme Decree N°.115-2025-PCM: Implementing Regulation of Law N° 31814.
  The AI Regulation establishes the classification of AI systems based on their level of risk (acceptable risk, high risk and forbidden use), setting forth, among other obligations, provisions on transparency, traceability, human oversight and privacy for high-risk systems. Among the systems classified as high-risk are (i) systems used in the education sector to carry out assessments involving children and adolescents, such as the access to an educational institution, evaluation of learning outcomes, assessment of the level of education, and identification of prohibited behaviors during exams and/or educational activities – exept when the system performs a complementary function and does not replace human pedagogical evaluation; (ii) systems to determine processes of recruitment, evaluation, hiring and termination of employees or job applicants, as well as to establish working conditions for employees; (iii) systems to determine the access, evaluation, prioritization and/or termination of social programs and/or household targeting; (iv) systems used to determine the creditworthiness of individuals (except when the use of AI is limited to financial fraud detection); (v) systems to determine the access to health and related services; (vi) systems that are used to provide medical suggestions, among others.    
• For acceptable-risk systems, compliance with the provisions of the Law and its Implementing Regulation must also be ensured throughout their development, implementation and use. 
  In addition, the National Artificial Intelligence Strategy (2026-2030) draft has been released for public consultation in September 2025, and several guidelines on the matter are expected to be issued soon.

The main competent authorities related to AI are as follows:

• The Secretariat of Government and Digital Transformation is the governing entity responsible for supervising compliance with the Law and its Implementing Regulation
• The National Institute for the Defense of Competition and Intellectual Property ("INDECOPI")
• The National Data Protection Authority

The AI Law Implementing Regulation establishes the classification of AI systems based on their level of risk:

1. acceptable risk; 
2. high risk; and 
3. forbidden use.

In general, the following systems are considered forbidden:

• Systems designed to deceptively or manipulatively influence individuals’ decision-making.
• Systems with autonomous lethal capability, involving decision-making without human oversight, which may cause physical harm or compromise personal integrity.
• Systems enabling mass surveillance without a legal basis or when such surveillance generates (or may generate) a disproportionate impact on the exercise of fundamental rights.
• Systems that analyze, classify or infer sensitive data based on biometric data to deduce or infer a person’s racial or ethnic origin, political opinions, religious beliefs, among others.
• Real-time biometric identification systems are used to categorize individuals in public spaces, except under specific exceptions.
• Systems that predict the possibility of an individual committing a crime based on profiling or the assessment of personal characteristics.

Among the high-risk systems, it is important to highlight the following categories:

• Systems used to manage national critical assets to support essential services (such as energy, telecommunications, health, transportation, water and banking, among others).
• Systems used in the education sector to carry out assessments involving children and adolescents, such as the access to an educational institution, evaluation of learning outcomes, assessment of the level of education, and identification of prohibited behaviors during exams and/or educational activities – except when the system performs a complementary function and does not replace human pedagogical evaluation; 
• Systems to determine processes of recruitment, evaluation, hiring and termination of employees or job applicants, as well as to establish working conditions for employees. 
• Systems to determine the access, evaluation, prioritization and/or termination of social programs and/or household targeting; 
• Systems used to determine the creditworthiness of individuals (except when the use of AI is limited to financial fraud detection); 
• Systems to determine access to health and related services; 
• Systems that are used to provide medical suggestions, among others.

The obligations regarding transparency, traceability, explainability and human oversight are established in the AI Implementing Regulation primarily for high-risk systems. Algorithmic impact assessments are voluntary for the private sector and mandatory for high-risk systems used by public administration entities.

General regulations (such as regulations on data protection, consumer protection, etcetera) may apply, depending on the case and the system. 

Peru’s cybersecurity regime is still evolving, combining several legal standards (cybercrime, data protection, sectoral rules, and defense) rather than one unified law. Key components include: 

• Law N°. 30096 – Law on Cybercrime: Substantive cybercrime law, setting offenses such as illegal access, misuse of devices/ information mechanisms.
• Law N°. 29733 – Personal Data Protection Law: Incorporates security/confidentiality obligations on data controllers and processors.
• Supreme Decree N°016-2024-JUS: Regulates Law N°.29733 and establishes mandatory security measures, notification duties and minimum technical standards.
• Urgency Decree 007-2020 – Digital Trust: Established a Digital Trust framework to strengthen digital confidence and obligations.
• Supreme Decree N°. 126-2025-PCM: Regulates Urgency Decree 007-2020 – Digital Trust. This Legal Framework ensures that all interactions of individuals with digital services, whether public or private in Peru are truthful, predictable, ethical, transparent, secure, inclusive, reliable, and of high quality.
• Law N°. 30999 – Cyber Defense Law: Establishes the legal regime for cyberdefense (i.e., the State’s power to act in defending the country from cyberattacks).
• Supreme Decree N°.017-2024-PCM: Operationalizes the cybersecurity governance model, defining institutional roles, risk-management duties and response mechanisms. 

Regarding any national cybersecurity strategy, Peru recently published a National Cybersecurity Strategy 2026-2028 ("ESNACIB"), which aims at improving resilience, protection of critical infrastructure, cyber threat intelligence, governance, incident response, digital trust and international cooperation. The ESNACIB is actively in public consultation. 

Peru’s cybersecurity regulations apply as follows:

• Financial Sector: Must apply Resolution N°. 504-2021 – Regulation on Data Security and Cybersecurity Management, issued by the Superintendency of Banking, Insurance and Pensions (known as "SBS")
• Digital/Basic Services, Health, Telecom and other essential services: fall under Urgent Decree 007-2020 and are required to notify security/digital incidents.
• Data Protection/Personal Data Controllers and Processors: operate under Law 29733 and its Regulation (Personal Data Protection Legal Framework).  

Yes. There are regulatory decisions in which private and public entities have been sanctioned for cybersecurity-related infringements, particularly where incidents exposed personal data or where entities failed to implement adequate security controls or to report incidents to the competent authority. Sanctions generally range from warnings and corrective orders to administrative fines, which may vary depending on the severity of the incident, the type and volume of affected data, the number of individuals impacted, and the degree of negligence involved. In more serious cases, authorities may also impose temporary suspension of data processing activities, mandatory remediation plans, or refer matters for potential criminal investigation where intentional misconduct or fraud is involved.

Yes, there are mandatory reporting/incident-notification obligations in Peru, the Urgency Decree 007-2020 that establishes the trust framework and defines the digital security incident framework. The following sectors are required to notify the National Centre for Digital Security about any digital security incident: Public administration entities, Digital service providers in the financial sector, Utilities (water, gas and electricity), Healthcare sector, providers of “basic services”/critical services and Internet service providers and other providers of critical infrastructure. 

Also, when personal data is involved, data controllers must notify both the affected data subjects and the ANPD, depending on the severity of the incident. Notification to the Authority is required within 48 hours of becoming aware of the incident when it involves (i) large volumes of personal data (in terms of quantity or type), (ii) a large number of affected individuals, (iii) sensitive personal data, or (iv) evident harm to the rights or freedoms of the data subjects. If the notification is delayed beyond 48 hours, justification must be provided. The notification must include the nature of the incident, the types of data affected, contact details of the Data Protection Officer or relevant contact point, possible consequences, and measures taken to mitigate the impact.

Data subjects must also be notified within 48 hours if the incident results in evident harm to their rights. The communication must be clear and easily understandable and must describe any actions taken to mitigate the impact. However, this obligation does not apply if the incident did not cause harm and was fully resolved by the data controller.

Additionally, data processors are required to immediately inform the data controller of any security incidents they become aware of. All incidents must be properly documented by the controller, including the facts, effects, and remedial actions taken, to allow verification by the ANPD.

Companies must notify the National Centre for Digital Security ("CNSD") and, if it involves personal data, within 48 hours of becoming aware of the incident, to the ANPD. In the case of the Financial Sector, they must report significant cybersecurity incidents to the SBS.

Yes, Law N°. 30096 –Computer Crimes Law establishes specific criminal provisions addressing unlawful conduct involving computer systems, data, and communication technologies. It defines and penalizes cyber-related offenses such as unauthorized access, system interference and other acts that compromise legally protected assets and digital environments. 

Peru participates in multiple international treaties and cooperation frameworks, mainly through the Budapest Convention on Cybercrime, the Inter-American Strategy for Cybersecurity, APEC and ITU. Peru is also participating in multiple Global Cybersecurity Initiatives such as ESNACIB, CERT/CSIRT cooperation and from international bodies such as the World Bank, Inter-American Development Bank and Digital Trust.