Verified against the official source

ARCO Rights in Peru: Access, Rectification, Cancellation and Objection to Your Personal Data

Short answer

Peru's Law N.° 29733 gives you six rights over your personal data: information, access, rectification/cancellation, blocking its transfer, opposition, and objective treatment. Anyone who handles your data must respond within 8, 10 or 20 business days depending on the right, free of charge. If they refuse or don't respond, you can complain to the National Personal Data Protection Authority (ANPD) or go straight to court via a habeas data action.

VerificationVerified against the official sourceSee the sources ↓

20sources cited
20read at the official source
2official institutions

SMV · Peruvian State portal (gob.pe)

Checked 1 Oct 2026Next review 28 Dec 2026

By Gyason · verified 1 Oct 2026

PeruviansForeign residentsBusinesses

Send on WhatsApp

The clock running against you

15 business days from notification of the decision resolving your protection procedure before the Dirección de Protección de Datos Personales.This is a caducidad period: once it lapses, the right itself is gone.

What day was it?

This is the deadline to appeal if you disagree with the ANPD's decision on your complaint. There is no statute-of-limitations for the initial ARCO request to the company or entity itself: you can file it at any time.

D.S. N.° 016-2024-JUS (Reglamento de la Ley 29733), art. 92.1, in line with art. 207.2 of the LPAG's consolidated text (D.S. N.° 006-2026-JUS)

What are ARCO rights?

ARCO is the name used to group the rights that Law N.° 29733, the Personal Data Protection Law, gives you over information that identifies you: Access, Rectification, Cancellation, and Objection. Peruvian law actually recognizes six distinct rights, plus a right to compensation if something goes wrong.

These rights exist because your information — your name, your ID number, your address, your income, your medical history, even a photo of you caught on a security camera — is “personal data” the moment it can identify you, and anyone who holds it in a data bank, whether a private company, a clinic, or a government entity, has legal obligations toward you.

The six rights the law recognizes

Right	What you can demand
Information (art. 18)	To be told, before your data is collected, what it will be used for.
Access (art. 19)	To get the information they hold about you in their data bank.
Rectification, update, cancellation and suppression (art. 20)	To update, complete or correct data that is inaccurate, incomplete or contains omissions, errors or falsehoods, and to delete data no longer necessary or relevant to the purpose it was collected for, or whose processing period has expired.
Blocking transfer (art. 21)	To block your data from being handed to third parties, especially when that affects your fundamental rights.
Objection (art. 22)	To refuse processing of your data when you have well-founded, legitimate reasons tied to your specific personal situation.
Objective treatment (art. 23)	Not to be subjected to a decision with legal effects on you (or that significantly affects you) based solely on processing of your data aimed at evaluating aspects of your personality or conduct; there are exceptions, such as negotiating or performing a contract or evaluations for joining a public entity, without prejudice to your right to defend your point of view.

Article 25 also gives you the right to compensation if a breach of the law by whoever handles your data — or by a third party — causes you harm.

How to file your request

The reglamento requires that your request, addressed directly to the data bank or the party responsible for processing, contain:

Your full name and proof of your identity (national ID or equivalent document).
The specific request: which right you’re exercising and exactly what you’re asking for.
An address, which can be an email, for notifications.
The date and your signature.
Any supporting documents, if relevant.

If your request has an error or is missing something, the controller has five days to tell you what’s missing, and you get another five days to fix it. If you don’t fix it within that window, your request is considered never filed.

How long they have to respond

The deadlines vary by right, and run from the day after you file your request:

Right	Maximum response deadline
Information	8 days
Access	20 days
Rectification, cancellation or objection	10 days

Except for the information deadline, all of these can be extended once, for an equal period, if circumstances justify it — and the controller must tell you that justification before the original deadline runs out.

Exercising these rights is free

Before privately-run data banks, exercising your ARCO rights costs nothing. The law expressly bans charging you an extra fee or requiring a payment method that would impose an excessive cost just to file your request.

What happens if they refuse or don’t respond

If the controller doesn’t respond within the deadline, the law treats your request as denied by silence. That implicit denial — just like an explicit, reasoned refusal — is what lets you move to the next level: complaining to the Dirección de Protección de Datos Personales, part of the National Personal Data Protection Authority (ANPD), under the Ministry of Justice and Human Rights.

How to complain to the ANPD: the protection procedure

If your request is denied or ignored, you can start an administrative procedure (called the “trilateral protection procedure”) before the Dirección de Protección de Datos Personales. To start it you need:

Proof of the request you sent directly to the controller.
The document containing their response (or proof they never responded).
Documents showing how your right was affected.

From there, the procedure runs like this:

The Dirección admits your complaint and notifies the other party, who has fifteen days to respond.
The Dirección resolves within a maximum of thirty days from the response (or from when the deadline to respond expired), extendable by up to thirty more days if the case is complex or requires an inspection.
At any stage you can request precautionary measures if you need urgent protection.

If you disagree with the decision: the appeal

Only an appeal can be filed against the decision on your complaint. The Dirección de Protección de Datos Personales must grant or deny the appeal, and if granted, sends the file up to the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales, which resolves within a maximum of thirty days. That decision exhausts the administrative channel.

The alternative: going straight to court

You don’t have to exhaust the administrative channel before going to a judge. The law gives you the option, from the start, of going to the ANPD through a complaint or directly to the courts through a habeas data action.

What sanctions the ANPD can impose on non-compliant entities

If a company or entity violates your rights, the ANPD can fine it:

Minor infractions: 0.5 to 5 UIT.
Serious infractions: more than 5 to 50 UIT.
Very serious infractions: more than 50 to 100 UIT.

In no case can the fine exceed 10% of the offender’s annual gross income.

The path of an ARCO complaint, step by step

You
You file your request directly with the data controller
The same day you decide to exercise your right, meeting the requirements of article 64 of the reglamento
Source: D.S. N.° 016-2024-JUS, Reglamento de la Ley N.° 29733, Artículo 64
The data bank or the party responsible for processing
The controller responds, or stays silent
8 days for the right to information, 20 days for access, or 10 days for rectification, cancellation or objection, counted from the day after the request was filed
Source: D.S. N.° 016-2024-JUS, Reglamento de la Ley N.° 29733, Artículo 69
You
If denied or ignored, you file your protection complaint
No statute-of-limitations set in the rule for filing this complaint
Source: D.S. N.° 016-2024-JUS, Reglamento de la Ley N.° 29733, Artículo 88, numerales 88.2 y 88.3
The other party
The Dirección de Protección de Datos Personales notifies the other party, who responds
15 days from being notified of your complaint
Source: D.S. N.° 016-2024-JUS, Reglamento de la Ley N.° 29733, Artículo 90
Dirección de Protección de Datos Personales
The Dirección resolves your complaint
30 days from the response (or from when the deadline to respond expired), extendable by up to 30 more days for complexity
Source: D.S. N.° 016-2024-JUS, Reglamento de la Ley N.° 29733, Artículo 91, numeral 91.1
Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales
If you appeal, the Dirección General issues the final administrative decision
30 days; that decision exhausts the administrative channel
Source: D.S. N.° 016-2024-JUS, Reglamento de la Ley N.° 29733, Artículo 92

These periods are counted differently, so we don't add them up.

The bars are to scale with each other; the longest is 60 business days.

At any point along this path you can choose to go straight to the courts through a habeas data action instead of complaining to the ANPD.

How to file

Identify who controls the data bankIt could be the company, clinic, government entity, or person holding your personal data in their data bank. That's who your request goes to.
Write your request meeting the legal requirementsInclude your full name and ID, the specific request (access, rectification, cancellation or objection), an address or email for notifications, the date, and your signature, plus any supporting documents if relevant.
File your request and keep proof of receiptSubmit it however the controller has set up (letter, email, web form) and keep the dated receipt confirmation — you'll need it if you have to complain later.
Wait for the response within the legal deadlineEight, ten, or twenty days depending on the right you're exercising, at no cost to you.
If denied or ignored, file your complaint with the Dirección de Protección de Datos PersonalesAttach the receipt of your original request and their response (or proof there was none) to start the protection procedure before the ANPD.
Go to the ANPD portal on gob.pe →
Consider going to court insteadInstead of complaining to the ANPD, or if you disagree with its decision, you can go directly to the courts through a habeas data action.

What people fail to ask in time

What if whoever holds your data never responds at all, not even to deny your request?

Find out before it matters →

What most people believe — and what the law says

The belief

Only big companies or the government have to respect these rights.

The law

The law applies to any natural or legal person, public or private, that processes your personal data in a data bank — from a clinic to a corner store with your phone number on a list.

The belief

You have to pay to request, correct, or delete your data.

The law

Exercising these rights before privately-run data banks is free by law; no additional fee or costly payment method can be required to exercise them.

The belief

If the company never responds, there's nothing more you can do.

The law

Silence counts as a denial of your request, and that denial — implicit or explicit — is exactly what lets you file a complaint with the Dirección de Protección de Datos Personales.

The belief

You can only complain if you're a customer of the company holding your data.

The law

The law protects your personal data regardless of any contractual relationship; anyone holding it in a data bank must respect your ARCO rights.

Frequently asked questions

How long does a company or entity have to give me access to my data?

Twenty days, counted from the day after you filed your request. For the right to information the deadline is eight days, and for rectification, cancellation or objection it's ten days. All of these deadlines, except information, can be extended once for an equal period if justified.

Is it free to exercise my ARCO rights?

Yes, before privately-run data banks exercising these rights is free by law. You cannot be charged an extra fee or required to use a costly method to file your request.

What happens if the company doesn't respond at all?

Silence counts as a denial of your request. That implicit denial, just like an explicit refusal, lets you start the protection procedure before the ANPD's Dirección de Protección de Datos Personales.

How do I complain to the ANPD if my rights are denied?

You file your complaint with the Dirección de Protección de Datos Personales, attaching proof of your original request and their response (or proof they never responded). The Dirección notifies the other party, who has fifteen days to respond, and then resolves within a maximum of thirty days, extendable by up to thirty more days if the case is complex.

Can I go straight to court instead of complaining to the ANPD?

Yes. The law gives you the option, from the start, of going to the National Personal Data Protection Authority through a complaint, or directly to the courts through a habeas data action — neither route forecloses the other.

What sanctions can the ANPD impose on someone who doesn't comply?

The ANPD can impose fines of 0.5 to 5 UIT for minor infractions, more than 5 to 50 UIT for serious ones, and more than 50 to 100 UIT for very serious ones, capped at 10% of the offender's annual gross income.