Consumer services

Peru: Antitrust, consumer protection and data protection challenges loom | Knowledge

The coming months will likely see significant changes and challenges for companies operating in Peru. In this article, we take a concise look at recent developments in legal frameworks affecting antitrust, consumer protection and data protection.

Antitrust: new rules for business mergers

Peruvian Law No. 31112, Establishing the Prior Control Regime for Business Concentration Operations[1] in Peru, and its regulations, entered into force on June 14, 2021. This law creates a prior control procedure under the supervision of the national consumer protection authority, Indecopi[2]concerning business control operations, in order to ensure competition and economic efficiency in the market for the welfare of consumers.

To be subject to the prior control procedure, a business concentration must meet the following two thresholds:

  1. During the tax year preceding that in which the concentration operation is notified, the total value of sales or the annual gross income or the value of the assets in Peru of the companies concerned reached a value equal to or greater than 118,000 fiscal units[3] and
  2. During the financial year preceding that in which the operation is notified, the value of the annual gross sales or revenues or the value of the assets in Peru of at least two of the companies involved in the concentration reached a value equal to or greater than more than 18,000[4] fiscal units, for each company.

In this regard, in 2022, companies participating in or contemplating a concentration of companies should carry out a comprehensive analysis of the gross revenues and the value of the assets of the companies concerned, in order to determine whether a notification to INDECOPI will be required.

Consumer protection and e-commerce

The fight against COVID-19 has changed consumer habits in several ways – in particular, in the spectacular growth of e-commerce, which is now seen as a way for consumers to acquire products and services that are not only fast but secure. This massive shift in consumer behavior is prompting many businesses to move away from traditional channels, such as brick-and-mortar stores, and embrace this new, convenient option from a consumer perspective.

Companies that offer and sell products and provide services through their web pages to Peruvian consumers should keep in mind the principles of Peruvian Law No. 29571, the Consumer Protection and Defense Code.[5]

This Code requires companies to ensure strict compliance with consumer rights; inform consumers about products and services through easily understandable terms; establish clear delivery deadlines and then meet these deadlines; clearly describe all charges related to delivery arrangements; and set up a return policy. As e-commerce continues to grow dramatically, companies doing business online in Peru are paying attention to the requirements of this law in 2022.

Consumer data protection

The growth of e-commerce also has implications for how businesses process and use consumers’ personal data.[6] In 2022, the Peruvian Data Protection Authority is focusing on oversight, paying particular attention to how companies (website owners) who act as data controllers[7] comply with the provisions established by Peruvian data protection legislation.

Therefore, any company that markets or intends to market its products and services via the Internet must take into consideration the following obligations:

  • Personal data must be processed in accordance with the principle of consent. In other words, personal data must not be processed without the consent of the data subject, unless one of the exceptions provided for by data protection legislation is in place. It is important to point out that due to recent decisions of the Data Protection Authority, data subjects must consent to the use of cookies that are not strictly necessary for the operation of the website (i.e. say preference or marketing cookies). In this regard, it is considered good practice to include a consent form on the website to inform users of the use of cookies and obtain their consent to such use.
  • Databases and any overseas transfer of personal data must be registered with the Peruvian Data Protection Authority.
  • Data subjects must be properly informed of the conditions under which their personal data is processed, in accordance with the duty to inform provided by the law on the protection of personal data.[8] This is usually addressed by privacy policies.
  • Personal data must be processed in accordance with the security measures provided for by data protection legislation.

To learn more about the implications of these changes for your business, contact one of the authors.


[1] According to Law No. 31112, a corporate control transaction is “any act or transaction that involves a transfer or change of control of the business, or part thereof.”

[2] INDECOPI is the multi-purpose regulatory body responsible for overseeing, among other areas of law, antitrust and consumer protection issues.

[3] Approximately $146,000,000.

[4] Approximately US$22,500,000.

[5] Consumer protection regulations are governed by Law No. 29571, Consumer Protection and Defense Code.

[6] Law No. 29733, Peru’s Personal Data Protection Law, defines “personal data” as “any information about a natural person that identifies that person or makes them identifiable by means that can reasonably be used”.

[7] According to Law No. 29733, the Peruvian Personal Data Protection Law, a data controller is “the person who determines the purpose of the processing of personal data”.

[8] In accordance with Law No. 29733, the Peruvian Personal Data Protection Law, the data subject must be informed in a simple, express and unequivocal manner, and before the data is collected, of the purpose for which their personal data will be processed; who are or could be the recipients, the existence of the database in which they will be stored, as well as the identity and address of its holder and, where applicable, of the person(s) responsible for processing his data personal data; the mandatory or optional nature of your answers to the questionnaire offered to you, in particular concerning sensitive data; the transfer of personal data; the consequences of providing your personal data and refusing to do so; the length of time your personal data will be retained; and the possibility of exercising the rights recognized by law and the means provided for this purpose.