Peru: Personal Data Protection Law Regulations (Supreme Decree No. 016-2024-JUS)

PeruRegulationApplicable

Supreme Decree No. 016-2024-JUS approves the new Regulations of the Personal Data Protection Law (Law No. 29733), repealing the previous framework under Supreme Decree No. 003-2013-JUS. The updated regulation modernizes Peru's data privacy framework, addressing contemporary challenges presented by digital technologies, automated processing, and artificial intelligence. Warden Watch focuses specifically on the provisions governing automated decision-making and profiling within recruitment and employment contexts. Article 87 establishes the fundamental right to objective data processing, granting individuals the right not to be subjected to decisions (automated or otherwise) that produce legal effects, generate discrimination, or significantly affect them, specifically including automated profiling to assess professional performance, economic standing, health, reliability, or behavior. Controllers must inform individuals about automated decisions and profiling under Article 6.1(8) and Article 87.2. The regulation does not mandate recurring third-party algorithmic bias audits or impose direct statutory duties on software providers.

Impact

What this means for HR and vendors

HR and recruitment teams

HR and recruitment teams operating in Peru must audit automated screening, CV parsing, and employee evaluation tools to identify systems that assess candidates or workers without human intervention. Employers must update privacy notices to explicitly inform candidates and workers when automated decision-making or behavioral profiling is utilized and disclose the practical consequences of such processing. Organizations must ensure that automated assessment tools do not produce discriminatory outcomes or evaluate professional performance in an arbitrary manner. This increases the importance of documenting automated evaluation workflows and establishing mechanisms to handle worker access and objection requests.

HR technology vendors

Providers of HR technology, automated screening software, and video interview scoring tools deployed in Peru face commercial expectations to assist employer clients with regulatory compliance. While Supreme Decree No. 016-2024-JUS places direct statutory obligations on employers as data controllers, providers should supply clear documentation explaining system logic, input parameters, and profiling criteria. Providers should configure applications to support human oversight and review workflows, preventing purely automated rejections by default. Additionally, software architectures should facilitate candidate data access and allow employers to disable automated decision mechanisms when contested.

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerAutomated Decision Safeguards

Right to Objective Data Processing and Restriction on Solely Automated Decisions

DeployerTransparency & Notice

Transparency and Notice of Automated Decisions and Profiling

DeployerImpact & Risk Assessment

Pre-Deployment Privacy and Profiling Risk Impact Assessment

ProviderProvider Information & Documentation

Provider Documentation and Human Intervention Functionality

OBLIGATION

APPLIES TO

STATUS

Keep up with changes to employment AI rules and cases.

Get an email when we add important regulation or litigation, or when a tracked matter materially changes.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.