Cybersecurity Policy Report, Peruvian Ministry Fines Bank for Violations of Data Privacy Law, (Sep 8, 2025)

By Tony Foley

Peru’s Ministry of Justice and Human Rights has issued a fine against a bank for violations of the country’s data protection law governing the unlawful use and processing of personal data.

The fines were imposed through the National Authority for the Protection of Personal Data (ANPD) on Alfin Banco SA for improperly using citizens’ personal data in violation of Law No. 28733, the Personal Data Protection Law (PDPL), according to a September 4 ministry press release. During its inspection, the ANPD found that the bank used the complainants’ personal data, like date of birth, location, address, telephone number, educational status, and employment status, received from a private credit reporting agency, without demonstrating the legitimate source of the data collected.

The country’s law regulating private credit reporting establishes that these entities may only disseminate data related to the credit assessment of individuals and are not permitted to share or allow access to other types of personal information. As a result of its findings, the ANPD fined Alfin Banco a total of 139.32 tax units (approximately 669,000 Peruvian soles, or $190,200) in two separate sanctions that may be accessed from the press release but are only available in Spanish. In addition, the ANPD reminded stakeholders that the public and private institutions may only process data under a valid legal basis as established under the PDPL.

News: LitigationEnforcement DataPrivacy DataSecurity