Peru Legal Mini-FAQ — Employee Monitoring, Consent, Notice and Proportionality

Do we need employee consent to monitor company devices

Peruvian law is consent-centric, but processing can also rely on other legal bases recognized in the Regulation and guidance. For workplace monitoring, obtain informed notice at minimum and consider consent in onboarding. Avoid sensitive-data capture.

Is a privacy notice required

Yes. Provide a clear notice describing purposes, legal basis, data categories, recipients and transfers, retention, ARCO rights and contact channels. Keep it accessible and reference it in telework policies.

What does proportionality mean

Use the least intrusive method that achieves a legitimate aim, limit to work hours, prefer sampling over continuous recording and restrict access to admins.

Must we register our databases

Yes. Controllers must register personal-data banks with the RNPDP before processing. Keep the registry updated.

Are cross-border transfers allowed

Yes with safeguards. Inform data subjects and use approved contractual clauses or transfer mechanisms. Peru issued implementation guidance for international transfers. Avoid transfers to countries lacking adequate protection unless you have appropriate safeguards or consent.

What are ARCO rights and timelines

ARCO stands for Access, Rectification, Cancellation and Opposition. Provide a request channel, verify identity and respond within legal deadlines. Document outcomes and update or delete data where applicable.

How long can we retain monitoring data

Only as long as needed for the stated purpose or legal obligation. Adopt a written schedule, set short defaults such as 14 to 30 days for routine monitoring and extend only for incidents.

Can we monitor personal or BYOD devices

Prefer company devices. If BYOD is permitted, containerize work profiles, limit collection to corporate apps and allow users to disable monitoring off duty.

Does telework law affect monitoring

Yes. Telework rules require a written policy. Align your monitoring scope, tools, schedules and support channels with that policy and your privacy notice.