71%
of Peru's 21 requirements are already met by European Union (GDPR). Here is what LPDP adds, biggest gaps first.
Base légalePortée et base légaleBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
LPDP adds3 Consent is the default basis; exceptions listed in the Law (public entities, public sources, contracts, health, anonymized data). No legitimate interests.
Law arts. 13, 14 · source ↗
EnregistrementGouvernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
LPDP adds2 Creation, modification and cancellation of personal data banks must be registered (free, automatic approval) with the National Registry.
Law art. 34; Reg. arts. 42-45 · source ↗
MarketingDroits des personnesGap
GDPR2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
LPDP adds3 Consent for marketing must be obtained directly; one first contact allowed to seek it, no further contact if refused; opt-outs handled within 10 days.
Reg. art. 26 · source ↗
ConservationGouvernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
LPDP adds2 Indefinite retention generally prohibited; processors keep data at most 2 years after the engagement ends; access logs kept at least 2 years.
Reg. arts. 31(2), 46(3) · source ↗
Information des personnesViolationsGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
LPDP adds3 Notify affected individuals within 48 hours, in plain language, when their rights are affected.
Reg. art. 34(3)-(4) · source ↗
Responsabilité pénaleApplicationGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
LPDP adds2 Penal Code offense for selling or trading non-public personal data without authorization: 2 to 5 years' imprisonment.
Penal Code art. 154-A · source ↗
Already covered by GDPR: Reach abroad, Consent, Sensitive data, Children, Rights, Request deadline, DPO required, DPO qualifications, DPIA, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.
A gap means LPDP is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
