Art. 15 of the Law on the Protection of Personal Data and Art. 18 of its corresponding Regulation stipulate that, in cases where the recipient country does not ensure an adequate level of data protection, the data controller must guarantee that the processing of personal data will be carried out in accordance with the Peruvian legal framework. This requirement, however, does not apply in the following circumstances:
- where the transmission of personal data occurs within the context of international judicial cooperation or the implementation of international trade agreements;
- in the context of international cooperation between intelligence agencies;
- when the transfer of personal data is necessary for the performance of a contractual relationship to which the data subject is a party;
- for transfers involving banking and securities operations;
- for the prevention, diagnosis, or medical or surgical treatment of the data subject; and
- where the data subject has given their informed consent to the transfer under these conditions.

Peru has joined several agreements with binding commitments to open transfers of data across borders. These include: the First Amending Protocol [which amends the Additional Protocol to the Framework Agreement of the Pacific Alliance (Arts. 13.11 and. 13.12(c)], the Australia - Peru Free Trade Agreement (Art. 13.11.2), and the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11.2).

The Law on the Protection of Personal Data and its Regulation establish a comprehensive data protection regime in Peru.

The Second Final Supplementary of Decree No. 1182, on the preservation of data derived from telecommunications, states that the concessionaires of public telecommunications services and the public entities related to these services must keep the data derived from telecommunications during the first 12 months in computer systems that allow their consultation and delivery online and in real-time. At the end of the aforementioned period, they must keep said data for an additional 24 months in an electronic storage system. The delivery of data stored for a period not exceeding twelve months is done online and in real-time after receiving judicial authorisation. In the case of data stored for a period greater than 12 months, it will be delivered within 7 days following the judicial authorisation under responsibility.
A similar obligation is prescribed in Art. 16.e of Law No. 27336, which stipulates that all natural or legal persons providing public telecommunications services must retain, for a minimum period of three years from the moment the relevant information is generated, the source records underlying call‑detail data and the billing of the services they operate.

Art. 37 of the Regulation of Law No. 29733 provides that the personal data bank holder or data controller, as well as the data processor, must appoint a personal data protection officer in certain circumstances. These include: (i) where a public entity carries out the processing; (ii) where the controller, data bank holder, or processor engages in the processing of large volumes of personal data, whether in terms of quantity or type, or where such processing may affect a large number of individuals, involves sensitive data, or may result in an apparent detriment to the rights or freedoms of the data subject; and (iii) where the core activities or primary business operations of the controller, data bank holder, or processor consist of the processing of sensitive personal data.

According to Art. 1 of Legislative Decree No. 662, the State promotes and guarantees both existing and future foreign investments in all sectors of economic activity and in any business or contractual form permitted by national legislation. Furthermore, Peru reportedly maintains an open regime for both domestic and foreign private investment, without foreign ownership restrictions in any sector relevant for digital trade.

Peru is a party to the Patent Cooperation Treaty (PCT).

Peru has a copyright regime under the Decree No. 822. However, the exceptions do not follow the fair use or fair dealing model, therefore limiting the lawful use of copyrighted work by others. Arts. 41-51 list the exceptions, which include the reproduction by reprographic means for teaching or examination purposes in educational institutions and the reproduction of a work for judicial or administrative proceedings, to the extent justified by the purpose to be achieved, among others.
Moreover, Peru is a member of the Andean Community of Nations and is subject to Decision 351, issued in 1993. Art. 22 of the Decision sets forth a list of mandatory exceptions in the internal market but also allows the adoption of additional exceptions in the domestic law of members, as long as they comply with the international standards of the so-called three-step test.

Copyright is not adequately enforced online in Peru. It is reported that pirated and counterfeit goods remain widely available in Peru, and right holders cite particular concerns regarding internet piracy and illicit recordings in cinemas.

Peru has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.

Peru has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Decision No. 486, Decree No. 1,075, and Decree No. 1,044 provide a framework for the effective protection of trade secrets. First, Art. 260 of Decision No. 486 defines trade secrets, and Art. 245 allows requesting precautionary measures to stop an alleged infringement, to obtain or retain evidence, or to ensure the effectiveness of the action or to receive compensation for damages. Moreover, Art. 3 of Legislative Decree No. 1,075 considers trade secrets as an element of industrial property, and Art. 13 of Decree No. 1,044 lists factual situations constituting trade secret infringement. INDECOPI ("Instituto Nacional de Defensa de la Competencia y de la Protección de la Propiedad Industrial") is the competent authority that applies the above-mentioned regulations in proceedings regarding trade secrets.

There is an obligation for passive infrastructure sharing in Peru to deliver telecom services to end users. It is practised in both the mobile and fixed sectors based on commercial agreements.
In the mobile segment, Art. 12 of Supreme Decree No. 024-2014-MTC, which regulates the registration framework for passive infrastructure providers for public mobile services, requires such providers to make their infrastructure available to public mobile telecommunications operators that request access, subject to the regime's conditions. In parallel, Law No. 30083 introduces mobile virtual network operators (MVNOs) and rural mobile infrastructure operators, and obliges mobile network operators to provide network access (“acceso a red”), which may encompass access arrangements involving network elements used to deliver mobile services.
In fixed wholesale markets, sharing obligations apply to operators designated as Proveedor Importante in the wholesale market for internet and data transmission. Telefónica del Perú S.A.A. was selected as a Proveedor Importante for Market No. 25 by Board Resolution No. 154-2019-CD/OSIPTEL, which imposes access and shared-use obligations on the designated provider. Board Resolution No. 132-2012-CD/OSIPTEL further requires the submission of an Oferta Básica de Compartición (OBC) under this regime, and Telefónica’s OBC was approved by General Management Resolution No. 00039-2016-GG/OSIPTEL.

Art. 75 of Supreme Decree No. 009-2025-EF provides that for service (including consultancy) to be performed outside Lima and Callao with a value is up to PEN 200,000 (approx. USD 60,000), the standard tender documents can grant a 10% scoring bonus (calculated over the total score) to bidders domiciled in the province where the service is delivered, or in neighbouring provinces, even if they are in a different department/region. For this purpose, the bidder’s domicile is the one recorded in its RNP registration certificate.

Pursuant to Art. 22 of Supreme Decree No. 013-2013-PRODUCE (implementing Art. 21 of Law No. 28,015, as amended by Law No. 29,034), State entities must grant preferences to micro and small enterprises (MSEs) in the procurement of goods and services, and in works contracting and consultancy, provided that the MSEs meet the applicable technical specifications. The Decree further requires public entities to programme at least 40% of their procurements to be fulfilled by MSEs, with priority for regional and local MSEs in the locality where the procurement is conducted or the public works are executed. In addition, State entities must allocate at least 40% to manufacturing micro, small and medium-sized enterprises (MSMEs) that produce goods or provide services within Peru, provided that they can supply them in terms of quality, timeliness, price, and competitiveness.
Art. 81 of Supreme Decree No. 009-2025-EF further provides that, if two or more offers tie, the award goes (in order) to the best technical score, then to a micro/small enterprise integrated by persons with disabilities, then to a micro/small enterprise (or a consortium fully composed of them).
Both the Law and the Decree are to be repealed by Law No. 32353 of May 2025, which enters into force the day after its implementing regulation is published. However, the implementing regulation has not yet been published.