Can a building, gym or hotel in Peru keep your ID card?

What the statute actually says

Article 30 of Ley 26497 does two things in one sentence. It bars anyone from demanding a document other than the DNI for identification. And it bars anyone from seizing or retaining it, “under responsibility.”

The second half is the part almost nobody knows, and it is broken daily at office buildings, gyms, clubs, concerts and company reception desks across Lima.

Showing is not surrendering

• Exhibit — show it, let them look, let them write down your name and number. Lawful and reasonable.
• Retain — keep the plastic while you are inside. Prohibited.

A business may require you to identify yourself. It may not take your document as collateral for a visitor badge.

What about photographing or photocopying it too?

That’s a different act from retention, and the rule is less clear-cut. No article expressly bans a private business from photographing or photocopying your DNI. But the ANPD, the data protection authority under Minjusdh, has sanctioned 11 companies at least 13 times between 2022 and 2026 for photographing it, as excessive processing of data. Article 7 of Law No. 29733 requires all processing to be «adecuado, relevante y no excesivo» (adequate, relevant and not excessive) for its purpose.

In RD 3322-2024-JUS/DGTAIPD-DPDP, the ANPD fined a bank 1.30 UIT, a minor infraction, on the charge of photographing, through a provider, the DNIs of people taking part in a campaign: it was enough to identify them «mediante la exhibición del Documento Nacional de Identidad (no fotografiarlo)». In RD 2047-2022-JUS/DGTAIPD-DPDP it sanctioned as minor a retailer that photographed the DNI when delivering online orders, and ordered it to prove it had deleted the photo. In the current regulation, that minor infraction is article 132.1 of D.S. 016-2024-JUS: processing data not needed for the purpose. All the sanctions we found are about photographs. We found none for a paper photocopy, and none against a hotel. It is not an absolute ban: it depends on what the copy is for.

A Minjusdh note from May 2025 gives the practical rule: «Cuando te soliciten tu DNI, debes mostrarlo para que corroboren tu identidad. No permitas que le tomen fotografías» (show it so they can confirm your identity; do not let them photograph it). What bank, telecom, notary and hotel rules actually ask for is in Can a hotel, bank or phone company ask for a copy of your DNI?.

For a hotel’s guest registry, showing the document so staff can copy the fields the regulation requires by hand (name, date of birth, nationality, place of residence, identity document, check-in and check-out dates, among others) is enough, and is what the rule asks for. Handing over a full image of the document, with your signature or ubigeo, gives data the registry does not ask for. In our reading of Law No. 29733 that is excessive, although we found no case against a hotel. If the establishment insists, you can decline and ask for the complaints book. The rest of what you can expect at a hotel is covered in what rights you have as a hotel or hostal guest.

One correction worth making explicitly: a claim circulates that a MINCETUR decree (S.D. No. 005-2021) expressly bans these photographs without your authorization. We read the decree’s full text and it doesn’t say that — it regulates the guest registry and the entry of minors, and never mentions photographing or photocopying a DNI anywhere in it (it does use the word “copy,” but for the certified birth-certificate copy it requires for minors, not for an identity document).

Public bodies: one extra rule

If you are dealing with a State entity, there is an additional prohibition. Decreto Legislativo 1246 bars public administration bodies from demanding a photocopy of your DNI. That norm reaches only the public administration — it does not apply to private businesses.

The carné de extranjería: the uncomfortable part

Ley 26497 was written for the DNI. We did not find any general rule that expressly forbids retaining a carné de extranjería, or one that treats it like the DNI for this purpose.

What the Migraciones rules do say: the carné is «el documento de identidad oficial» (the official identity document) of resident foreigners (article 17.1 of Decreto Legislativo 1350). Public and private entities «deben reconocer» (must recognise) identity documents issued by Migraciones (article 15.8). Toward Migraciones, the police and other authorities, a foreigner’s duty is to exhibit the document (article 10.1, letter a). And hotels must require «la presentación» (the presentation) of the document and record its type and number (article 182.1 of the Regulation, as worded by D.S. 011-2024-IN). None of these rules authorises anyone to keep the carné, but none forbids it in so many words. That retention is not allowed is our reading, not a quoted prohibition.

There is one written exception, but a narrow one: private employment agencies are barred from «retener cualquier tipo de documento de identidad personal, nacional o extranjero» (retaining any type of personal identity document, national or foreign), and doing so is a very serious labour infraction (D.S. 020-2012-TR, article 7, letter c, and D.S. 019-2006-TR, article 31.6, both as added by D.S. 009-2021-TR). That rule does not reach buildings, gyms or hotels. This is the text added in 2021; we did not check whether it changed since.

Where the gap is

Article 30 forbids retention but sets no fine and names no enforcing agency. In practice that leaves three routes, none of them clean:

1. Data protection (Minjusdh) — the route with a penalty scale if they also copy or record your data. For retention alone, that it applies is our reading, not something the rule says.
2. Indecopi, if framed as a service-quality failure or an unjustified access restriction.
3. Defensoría del Pueblo, when the body holding your document is public.

We will not tell you “Indecopi fines businesses X UIT for keeping your ID,” because we found no decision supporting it. What is true, and enough in most encounters, is that the conduct is prohibited by statute and naming the article out loud usually ends the conversation.

What if the fined business doesn’t pay?

That fine can also be collected through seizure, without a judge. What happens if they don’t pay the fine?