Art. 47(e) of the Public Procurement Act, Cap. 15.10, requires the evaluation of technical proposals for consultancy services procured through international competitive tendering to take into account the extent of participation by nationals among key staff in the performance of the public procurement.

Pursuant to Art. 7.1 of Supreme Decree No. 016-2024-JUS, which approves the Regulation of Law No. 29733 on Personal Data Protection, the controller of a personal data bank, or the person responsible for it, whether located within or outside Peruvian territory, must (unless the processing is carried out solely for transit purposes) ensure the means necessary to comply effectively with the obligations established in the Law and the Regulation, and appoint a representative in Peru (or for Peruvian territory) as the contact point with the National Personal Data Protection Authority. Art. 2 defines a personal data bank as "a set of data on natural persons, whether computerised or not, structured according to specific criteria, which allows access to personal data without disproportionate effort, whether centralised, decentralised or distributed functionally or geographically".

The Consumer Protection Code Law provides a comprehensive consumer protection framework that applies to online transactions. According to Art. 2 of the law, the purpose of the Code is to enable consumers to access suitable products and services and to enjoy the rights and effective mechanisms for their protection, reducing information asymmetry and correcting, preventing, or eliminating conduct and practices that affect their legitimate interests.

Peru has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Peru has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Peru enacted the Digital Signatures and Certificates Act, drawing upon the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Art. 37 of the Regulation of Law No. 29733 provides that the personal data bank holder or data controller, as well as the data processor, must appoint a personal data protection officer in certain circumstances. These include: (i) where a public entity carries out the processing; (ii) where the controller, data bank holder, or processor engages in the processing of large volumes of personal data, whether in terms of quantity or type, or where such processing may affect a large number of individuals, involves sensitive data, or may result in an apparent detriment to the rights or freedoms of the data subject; and (iii) where the core activities or primary business operations of the controller, data bank holder, or processor consist of the processing of sensitive personal data.

A basic legal framework on intermediary liability for copyright infringement is absent in Peru's law and jurisprudence. In addition, complaints are reported regarding long-standing enforcement problems with the intellectual property (IP) provisions of the Peru-US Free Trade Agreement (Chapter 16, Art. 16.11.29), in particular with respect to the establishment of statutory damages for copyright infringement and trademark counterfeiting, and the notice and takedown and safe harbour system for Internet Service Providers (ISPs). Moreover, this is reiterated with respect to the rules relating to ISP liability in the EU-Peru-Colombia-Ecuador Agreement (Section 29). Finally, the Comprehensive Trans-Pacific Partnership Agreement, Chapter 18, Art. 18.82, includes relevant provisions limiting ISP liability and promoting a safe harbour for ISPs. However, the national implementation of intermediate liability rules for service providers is still pending, and there is no clear timetable.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Peru's law and jurisprudence.

Under Resolution No. 172-2022-CD/OSIPTEL, issued by the Supervisory Agency for Private Investment in Telecommunications (Organismo Supervisor de Inversión Privada en Telecomunicaciones, OSIPTEL), mobile operators must maintain updated subscriber registries for prepaid, control and postpaid services. Annex 5, point 2.7 requires these registries to include the subscriber’s identification data, telephone number, activation date and time and, where applicable, the biometric verification record. The service may be activated only after the applicant’s identity has been verified and the required information registered.
Annex 5, points 3.1–3.4 require operators to verify applicants using fingerprint biometrics against the National Registry of Identification and Civil Status (Registro Nacional de Identificación y Estado Civil, RENIEC) database, subject to limited exceptions. The framework also requires the registration of information on the mobile terminal used to provide the service, including its International Mobile Equipment Identity (IMEI), electronic serial number, International Mobile Subscriber Identity (IMSI), brand, model, contract modality and service status. This information supports the National Registry of Mobile Terminal Equipment for Security (Registro Nacional de Equipos Terminales Móviles para la Seguridad, RENTESEG).

Under Art. 245(1)(a) and (3)(a) of the Consolidated Text of the General Regulations of the Telecommunications Law, approved by Supreme Decree No. 020-2007-MTC, and Art. 1 of Directoral Resolution No. 0005-2022-MTC/27, certain telecommunications equipment requires a prior “internamiento” permit, even if it has already been type-approved. The covered products include cellular base stations, wireless modems and repeaters, Very Small Aperture Terminal (VSAT) equipment, radiotelephones, telecommunications antennas, radio and television transmitters, satellite receivers and TV box adapters. Applicants must generally be registered telecommunications equipment dealers or hold a relevant telecommunications concession, authorisation or value-added services registration. Equipment imported for private use is exempt where the quantity does not exceed five units per trip or shipment. Applications must be submitted electronically through the Single Window for Foreign Trade (VUCE).

According to Art. 63 of the Telecommunications Law, all equipment or apparatus that must be connected to a public network to provide any service, or that is used to emit radioelectric energy, must have the corresponding approval certificate (“certificado de homologación”). According to Art. 75 of the Law, this procedure is carried out by the Peruvian Government through the Ministry of Transport and Communications, which can delegate powers to entities and laboratories for measurements and tests.
According to Art. 8 of the Specific Regulations for Homologation of Telecommunications Equipment and Apparatus, the homologation of telecommunications equipment and/or devices that produce radioelectric emissions is subject to the payment of a processing fee, and applicants must submit a copy of the technical manual with specifications for the equipment or appliance to be approved, indicating the mark, model, and name and address of the manufacturer. Ministerial Resolution N. 521-2008-MTC/03 established the recognition of approval certificates or similar documents for telecommunications equipment and devices from the United States and Canada.

Peru implements a de minimis threshold, that is the minimum value of goods below which customs do not charge duties, equal to USD 200. Under the courier regulation approved by Supreme Decree No. 192-2020-EF, shipments are classified by category, and Category 2 covers goods with a FOB value of up to USD 200 per shipment, which are not subject to import duties. This threshold aligns with the International Chamber of Commerce (ICC) recommended global baseline de minimis level of USD 200 or more.

Peru has joined several agreements with binding commitments to open transfers of data across borders. These include: the First Amending Protocol [which amends the Additional Protocol to the Framework Agreement of the Pacific Alliance (Arts. 13.11 and. 13.12(c)], the Australia - Peru Free Trade Agreement (Art. 13.11.2), and the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11.2).

The Law on the Protection of Personal Data and its Regulation establish a comprehensive data protection regime in Peru.