Art. 37 of the Regulation of Law No. 29733 provides that the personal data bank holder or data controller, as well as the data processor, must appoint a personal data protection officer in certain circumstances. These include: (i) where a public entity carries out the processing; (ii) where the controller, data bank holder, or processor engages in the processing of large volumes of personal data, whether in terms of quantity or type, or where such processing may affect a large number of individuals, involves sensitive data, or may result in an apparent detriment to the rights or freedoms of the data subject; and (iii) where the core activities or primary business operations of the controller, data bank holder, or processor consist of the processing of sensitive personal data.

A basic legal framework on intermediary liability for copyright infringement is absent in Peru's law and jurisprudence. In addition, complaints are reported regarding long-standing enforcement problems with the intellectual property (IP) provisions of the Peru-US Free Trade Agreement (Chapter 16, Art. 16.11.29), in particular with respect to the establishment of statutory damages for copyright infringement and trademark counterfeiting, and the notice and takedown and safe harbour system for Internet Service Providers (ISPs). Moreover, this is reiterated with respect to the rules relating to ISP liability in the EU-Peru-Colombia-Ecuador Agreement (Section 29). Finally, the Comprehensive Trans-Pacific Partnership Agreement, Chapter 18, Art. 18.82, includes relevant provisions limiting ISP liability and promoting a safe harbour for ISPs. However, the national implementation of intermediate liability rules for service providers is still pending, and there is no clear timetable.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Peru's law and jurisprudence.

Under Resolution No. 172-2022-CD/OSIPTEL, issued by the Supervisory Agency for Private Investment in Telecommunications (Organismo Supervisor de Inversión Privada en Telecomunicaciones, OSIPTEL), mobile operators must maintain updated subscriber registries for prepaid, control and postpaid services. Annex 5, point 2.7 requires these registries to include the subscriber’s identification data, telephone number, activation date and time and, where applicable, the biometric verification record. The service may be activated only after the applicant’s identity has been verified and the required information registered.
Annex 5, points 3.1–3.4 require operators to verify applicants using fingerprint biometrics against the National Registry of Identification and Civil Status (Registro Nacional de Identificación y Estado Civil, RENIEC) database, subject to limited exceptions. The framework also requires the registration of information on the mobile terminal used to provide the service, including its International Mobile Equipment Identity (IMEI), electronic serial number, International Mobile Subscriber Identity (IMSI), brand, model, contract modality and service status. This information supports the National Registry of Mobile Terminal Equipment for Security (Registro Nacional de Equipos Terminales Móviles para la Seguridad, RENTESEG).

Under Art. 245(1)(a) and (3)(a) of the Consolidated Text of the General Regulations of the Telecommunications Law, approved by Supreme Decree No. 020-2007-MTC, and Art. 1 of Directoral Resolution No. 0005-2022-MTC/27, certain telecommunications equipment requires a prior “internamiento” permit, even if it has already been type-approved. The covered products include cellular base stations, wireless modems and repeaters, Very Small Aperture Terminal (VSAT) equipment, radiotelephones, telecommunications antennas, radio and television transmitters, satellite receivers and TV box adapters. Applicants must generally be registered telecommunications equipment dealers or hold a relevant telecommunications concession, authorisation or value-added services registration. Equipment imported for private use is exempt where the quantity does not exceed five units per trip or shipment. Applications must be submitted electronically through the Single Window for Foreign Trade (VUCE).

According to Art. 63 of the Telecommunications Law, all equipment or apparatus that must be connected to a public network to provide any service, or that is used to emit radioelectric energy, must have the corresponding approval certificate (“certificado de homologación”). According to Art. 75 of the Law, this procedure is carried out by the Peruvian Government through the Ministry of Transport and Communications, which can delegate powers to entities and laboratories for measurements and tests.
According to Art. 8 of the Specific Regulations for Homologation of Telecommunications Equipment and Apparatus, the homologation of telecommunications equipment and/or devices that produce radioelectric emissions is subject to the payment of a processing fee, and applicants must submit a copy of the technical manual with specifications for the equipment or appliance to be approved, indicating the mark, model, and name and address of the manufacturer. Ministerial Resolution N. 521-2008-MTC/03 established the recognition of approval certificates or similar documents for telecommunications equipment and devices from the United States and Canada.

Peru implements a de minimis threshold, that is the minimum value of goods below which customs do not charge duties, equal to USD 200. Under the courier regulation approved by Supreme Decree No. 192-2020-EF, shipments are classified by category, and Category 2 covers goods with a FOB value of up to USD 200 per shipment, which are not subject to import duties. This threshold aligns with the International Chamber of Commerce (ICC) recommended global baseline de minimis level of USD 200 or more.

Art. 75 of Supreme Decree No. 009-2025-EF provides that for service (including consultancy) to be performed outside Lima and Callao with a value is up to PEN 200,000 (approx. USD 60,000), the standard tender documents can grant a 10% scoring bonus (calculated over the total score) to bidders domiciled in the province where the service is delivered, or in neighbouring provinces, even if they are in a different department/region. For this purpose, the bidder’s domicile is the one recorded in its RNP registration certificate.

Pursuant to Art. 22 of Supreme Decree No. 013-2013-PRODUCE (implementing Art. 21 of Law No. 28,015, as amended by Law No. 29,034), State entities must grant preferences to micro and small enterprises (MSEs) in the procurement of goods and services, and in works contracting and consultancy, provided that the MSEs meet the applicable technical specifications.
The Decree further requires public entities to programme at least 40% of their procurements to be fulfilled by MSEs, with priority for regional and local MSEs in the locality where the procurement is conducted or the public works are executed. In addition, State entities must allocate at least 40% to manufacturing micro, small and medium-sized enterprises (MSMEs) that produce goods or provide services within Peru, provided that they can supply them in terms of quality, timeliness, price, and competitiveness.
Art. 81 of Supreme Decree No. 009-2025-EF further provides that, if two or more offers tie, the award goes (in order) to the best technical score, then to a micro/small enterprise integrated by persons with disabilities, then to a micro/small enterprise (or a consortium fully composed of them).
Both the Law and the Decree are to be repealed by Law No. 32353 of May 2025, which enters into force the day after its implementing regulation is published. However, the implementing regulation has not yet been published.

Foreign companies have reported challenges in Peru’s public procurement system since at least 2013, when firms have identified corruption as a significant concern, particularly in government procurement processes, with defence and police procurement considered among the most problematic areas. Since 2019, private-sector stakeholders have also described government procurement processes as cumbersome and inefficient, citing procedural complexity, delays in decision-making and difficulties participating in certain procurement mechanisms.

Peru is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

According to Art. 1 of Legislative Decree No. 662, the State promotes and guarantees both existing and future foreign investments in all sectors of economic activity and in any business or contractual form permitted by national legislation. Furthermore, Peru reportedly maintains an open regime for both domestic and foreign private investment, without foreign ownership restrictions in any sector relevant for digital trade.

Peru is a party to the Patent Cooperation Treaty (PCT).

Peru has a copyright regime under the Decree No. 822. However, the exceptions do not follow the fair use or fair dealing model, therefore limiting the lawful use of copyrighted work by others. Arts. 41-51 list the exceptions, which include the reproduction by reprographic means for teaching or examination purposes in educational institutions and the reproduction of a work for judicial or administrative proceedings, to the extent justified by the purpose to be achieved, among others.
Moreover, Peru is a member of the Andean Community of Nations and is subject to Decision 351, issued in 1993. Art. 22 of the Decision sets forth a list of mandatory exceptions in the internal market but also allows the adoption of additional exceptions in the domestic law of members, as long as they comply with the international standards of the so-called three-step test.

Copyright is not adequately enforced online in Peru. It is reported that pirated and counterfeit goods remain widely available in Peru, and right holders cite particular concerns regarding internet piracy and illicit recordings in cinemas.