Skip to main content

    AI by country · South America

    AI in Peru: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Peru know before starting with AI?

    Peru has an AI law, Law 31814 of 2023, and a regulation, Supreme Decree 115-2025-PCM, that sets prohibited and high-risk uses. Its duties for private companies phase in over one to four years by sector, starting with health, education, justice, security, economy and finance. Personal data in AI is also covered by Law 29733 and its 2024 regulation, which requires breach notice within 48 hours.

    At a glance

    Peru at a glance

    Key facts about Peru
    Data protection lawPersonal Data Protection Law, Law 29733 (2011), with a new regulation (Supreme Decree 016-2024-JUS) in force since 30 March 2025
    RegulatorAutoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice; for AI, the Secretaría de Gobierno y Transformación Digital (PCM)
    AI policyLaw 31814 (July 2023) and its regulation, Supreme Decree 115-2025-PCM (September 2025), phasing in
    Time zoneUTC-5, no daylight saving (India is 10.5 hours ahead)
    CurrencyPEN (Peruvian sol)
    Business languageSpanish

    Why now

    Why Peru is worth watching

    Each point links to the document it comes from.

    • Law 31814, published on 5 July 2023, promotes the use of AI and names a risk-based approach and privacy among its principles.[1]

    • Its regulation, Supreme Decree 115-2025-PCM, was published on 9 September 2025 and mostly took effect 90 working days later.[2]

    • Private companies in health, education, justice, security, economy and finance have one year from publication to comply. Transport, commerce and labour have two years, and production, agriculture, energy and mining three.[2]

    • A new data protection regulation took effect on 30 March 2025. It requires breach notice to the authority and to affected people within 48 hours.[6]

    • Large companies, with annual sales above 2,300 UIT, had one year to appoint a personal data officer where required; smaller firms get two to four years.[4]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Law 31814, promoting the use of AI for economic and social development

    In force2023It sets principles, including risk-based safety standards, ethical development and privacy. It makes the Presidency of the Council of Ministers, through its Digital Government Secretariat, the national authority for AI.[1]

    Supreme Decree 115-2025-PCM, regulation of Law 31814

    Phased2025It bans uses such as manipulation, mass surveillance without legal basis and inferring sensitive traits from biometrics. High-risk uses include hiring, credit scoring, health triage and evaluating children. These need clear notice to users, trained staff who can override decisions, and security and risk measures. For private firms an impact assessment is voluntary but must be documented and kept for three years.[2]

    Personal Data Protection Law, Law 29733

    In force2011It covers any AI that processes personal data. Data may go abroad only where the receiving country offers a sufficient level of protection, or with added safeguards. The data protection authority can fine breaches.[5]

    Supreme Decree 016-2024-JUS, new regulation of Law 29733

    In force2024Breaches must be reported to the authority within 48 hours, and digital incidents also to the National Digital Security Centre. A data officer is required for large-scale or sensitive data processing. It also covers foreign companies that profile people in Peru, who must appoint a representative there.[6]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Fraud detection and Spanish-language customer service, with staff reviewing credit decisions.

    Credit scoring is high risk under Supreme Decree 115-2025-PCM, with fraud detection excluded. Finance has a one-year adaptation period.[2]

    Health care

    Summarising clinical notes, with clinicians making decisions.

    AI for access to health services, diagnosis or triage is high risk. Health also has a one-year adaptation period.[2]

    Mining and energy

    Predictive maintenance and search over technical documents, using mostly non-personal data.

    AI managing critical assets for essential services, such as energy, is high risk. Production, energy and mining have three years to adapt.[2]

    Human resources

    Drafting job descriptions and sorting applications, with people making hiring decisions.

    AI used to hire, evaluate or dismiss workers is high risk under the regulation.[2]

    Your first steps

    Your first steps

    1. List your AI uses and check each against the prohibited and high-risk lists in Supreme Decree 115-2025-PCM.
    2. Work out your sector's adaptation deadline. For health, education, justice, security, economy and finance it is one year from 9 September 2025.
    3. For high-risk uses, tell users clearly that AI is involved and train staff who can stop or override its decisions.
    4. Write and keep an impact assessment for high-risk AI, even though it is voluntary for private firms.
    5. Set up a breach process that can notify the data protection authority and affected people within 48 hours.
    6. Check whether you must appoint a personal data officer, and by when for your company size.
    7. Map data sent abroad, including to AI and cloud providers, and add safeguards where the country's protection is not sufficient.

    AI services for Peru

    AI consulting and development for teams in Peru

    We work remotely with companies in Peru, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Peru is on UTC-5 and India on UTC+5:30, so India is 10.5 hours ahead. A 9:00 to 18:00 day in Peru and 9:30 to 18:30 in India do not overlap at all: 18:30 in India is 08:00 in Lima. So we agree a short early-morning (Peru) and evening (India) call window, for example 07:30 to 08:30 in Lima, and send written updates at the end of each Indian day so work is ready when your morning starts.

    Questions

    Common questions about AI in Peru

    Does Peru have an AI law?

    Yes. Law 31814 of 2023 promotes AI use, and Supreme Decree 115-2025-PCM sets the detailed rules, including prohibited and high-risk uses. Duties for private companies phase in by sector over one to four years from September 2025.

    Is our AI high risk?

    It may be if it is used for hiring, credit scoring, access to health care, evaluating children in education, access to social programmes or managing critical infrastructure. Fraud detection is excluded from the credit scoring category.

    Who enforces the AI rules?

    The Presidency of the Council of Ministers, through the Secretaría de Gobierno y Transformación Digital. It issues guidelines, monitors prohibited and high-risk uses and reports to Congress every year.

    How fast must we report a data breach?

    Within 48 hours of detection to the data protection authority, under the 2024 regulation. Affected people must be told in the same time, and digital incidents also go to the National Digital Security Centre.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Congreso de la República del Perú, 2023-07-05. Ley 31814, Ley que promueve el uso de la inteligencia artificial en fav…(leyes.congreso.gob.pe)
      Full title and what we used it for

      Ley 31814, Ley que promueve el uso de la inteligencia artificial en favor del desarrollo económico y social del país (texto consolidado). Primary law text. Used for the publication date, principles and the national authority (article 4).

    2. [2] El Peruano (official gazette), 2025-09-09. Decreto Supremo 115-2025-PCM, Reglamento de la Ley 31814(busquedas.elperuano.pe)
      Full title and what we used it for

      Decreto Supremo 115-2025-PCM, Reglamento de la Ley 31814. Primary. Used for entry into force, prohibited and high-risk uses, duties for high-risk systems, the authority and the phased timetable by sector and company size.

    3. [3] El Peruano, 2024-11-30. Protección de datos personales: Ejecutivo aprueba nuevo reglamento de l…(elperuano.pe)
      Full title and what we used it for

      Protección de datos personales: Ejecutivo aprueba nuevo reglamento de la Ley 29733. State newspaper report. Used for Supreme Decree 016-2024-JUS, the 48 hour breach notice and the phased data officer duty.

    4. [4] Pérez-Llorca, 2026-10-29. Se aprueba nuevo Reglamento de la Ley de Protección de Datos Personales(perezllorca.com)
      Full title and what we used it for

      Se aprueba nuevo Reglamento de la Ley de Protección de Datos Personales. Law firm summary, accessed on this date, used for interpretation: entry into force 120 days after publication and the data officer deadlines by company size.

    5. [5] Hunton Andrews Kurth, 2011-08-16. English translation of Peru's Law for Personal Data Protection released(hunton.com)
      Full title and what we used it for

      English translation of Peru's Law for Personal Data Protection released. Law firm summary, used for interpretation of Law 29733: dates, the cross-border transfer rule and the authority's power to fine. The Congress copy of the law is a scanned image we could not read.

    6. [6] CMS Grau, 2026-10-29. Nuevo Reglamento de Protección de Datos Personales(cms.law)
      Full title and what we used it for

      Nuevo Reglamento de Protección de Datos Personales. Law firm summary, accessed on this date, used for interpretation of Supreme Decree 016-2024-JUS: entry into force on 30 March 2025, 48 hour notice to the authority, people and the National Digital Security Centre, data officer cases, transfer criteria and reach to foreign companies.

    This is general information, not legal advice. Peru's AI rules are new and phase in by sector, and parts of this page rely on law firm summaries. Check with a qualified Peruvian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Peru?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score