Peru Recording Laws: One-Party Consent, Penalties, and AI Rules (2026)

Quick Answer: Is Peru One-Party or Two-Party Consent?

Peru is a one-party consent country for recording conversations.

Any person who is a participant in a conversation may record it without notifying the other party or obtaining their permission. This applies equally to phone calls, video calls, in-person conversations, and digital messaging. The participant recording their own conversation does not commit a crime under Peruvian law.

What the law prohibits is third-party interception: a person outside the conversation who taps into, monitors, or records communications they are not part of faces criminal penalties that range from 2 to 15 years in prison depending on the method and circumstances.

Peru's one-party consent standard is not written into a single statute using those words. It has developed through the doctrina del riesgo (risk doctrine), confirmed through binding decisions of the Corte Suprema de Justicia and the Tribunal Constitucional. The most recent Supreme Court affirmation came in Apelacion 221-2024 (San Martin), decided in 2024.

Understanding this distinction between participant recording and third-party interception is the foundation of everything that follows.

Constitutional Foundation: Article 2, Clause 10

Peru's 1993 Political Constitution (Constitucion Politica del Peru) establishes communication secrecy as a fundamental right in Article 2, paragraph 10 (inciso 10). The provision declares that every person has the right to the secrecy and inviolability of their private communications and private documents.

The constitutional text names a single exception. Private communications may be opened, seized, intercepted, or monitored only by a reasoned judicial order (mandato motivado del juez) issued in accordance with the law and with proper procedural safeguards. The authorizing judge must set out the legal basis in writing.

The Constitution also states that evidence obtained in violation of this right has no legal effect in any proceeding. This exclusionary principle reinforces the strict limits on government-ordered surveillance.

The constitutional protection is directed at third-party intrusion, not at participants preserving their own conversations. Peru's courts have applied this reading consistently. The Tribunal Constitucional stated in its ruling on Case No. 00867-2011-AA that the right to the inviolability of communications is not violated when one of the parties to a communication records it for themselves, or when a party voluntarily and expressly authorizes a third person to access the communication.

Codigo Penal Art. 154: Violation of Intimacy

Article 154 of the Penal Code is the foundational privacy offense. It falls under Title IV (Crimes Against Liberty), Chapter III (Violation of Intimacy), and applies broadly to personal and family privacy.

Base offense. Anyone who violates the intimacy of personal or family life by observing, listening to, or recording any fact, word, writing, or image using technical instruments or other means faces up to 2 years in prison and 60 to 120 days of fines.

Enhanced penalties for disclosure. When the offender reveals or distributes the intimate information obtained, the penalty rises to 1 to 3 years and 120 to 180 days of fines.

Social media distribution. When the offender uses social media or mass-communication platforms to spread the material, the penalty increases to 2 to 4 years and 180 to 365 days of fines.

The violation of intimacy offense applies when a non-participant observes, listens to, or records another person's private life without consent. It does not apply when a participant records their own conversation. Art. 154 is prosecuted as a private criminal action (accion privada / querella): only the aggrieved person can initiate a complaint. The Ministerio Publico does not pursue these cases on its own initiative.

Codigo Penal Art. 154-A: Illegal Trafficking of Personal Data

Article 154-A is a distinct and more recent provision that targets the commercial exploitation of personal data rather than simple intimacy violations.

Core offense. The article criminalizes the illegal commercialization, sale, or any other form of transmission of non-public personal data relating to any aspect of a person's personal, family, patrimonial, labor, financial, or other comparable sphere.

Penalty. The offense carries 3 to 5 years in prison.

Public prosecution. Unlike Art. 154 and most other intimacy crimes in this chapter, Art. 154-A is prosecuted publicly (accion publica). The Ministerio Publico can open an investigation without waiting for a private complaint from the victim. This reflects the legislature's view that illegal data trafficking poses a broader social harm beyond the immediate victim.

Art. 154-A intersects with Ley 29733 (Personal Data Protection Law). A single incident of illegally selling or transmitting personal data can trigger both criminal liability under Art. 154-A and administrative sanctions from the ANPD under Ley 29733.

Codigo Penal Art. 154-B: Non-Consensual Intimate Images (NCII)

Article 154-B criminalizes the non-consensual distribution of sexually explicit material involving a person with whom the perpetrator had or continues to have an intimate or trust relationship.

Core offense. Anyone who, without consent and with intent, distributes, threatens to distribute, or makes accessible images, audiovisual material, or audio of a sexual nature faces 3 to 6 years in prison.

The offense requires: (1) sexual content, (2) lack of consent from the person depicted, and (3) an existing or prior intimate or trust relationship between the parties. The law targets so-called revenge porn and sextortion.

Ley 32314 (April 2025) added AI-generated NCII to the aggravating landscape. When the intimate material is fabricated or manipulated using artificial intelligence or deepfake technology, enhanced penalty provisions elsewhere in the Penal Code apply. See the Deepfake section below for details.

Codigo Penal Art. 161: Violation of Correspondence Secrecy

Article 161 protects the secrecy of sealed correspondence and private communications. It punishes anyone who opens a sealed letter or document, intercepts private telecommunications, or takes knowledge of its contents without being the recipient or without the recipient's consent.

Penalty. The offense carries 2 to 4 years in prison and 60 to 90 days of fines.

Art. 161 is broader in scope than the telephone-specific Art. 162. It captures any sealed correspondence or private communication regardless of the medium, provided the perpetrator is not a party to the communication. The word "intercepts" in Art. 161 overlaps with Art. 162 but Art. 161 serves as a residual provision for communications not explicitly covered by the more specific articles.

The article does not apply when the communication is addressed to the perpetrator, or when the recipient has freely authorized the third party to access the content.

Codigo Penal Art. 162: Telephone Interception

Article 162 is the primary criminal provision for unauthorized telephone surveillance. It sits in Chapter IV (Violation of Communication Secrecy) within the same Title IV.

Base Offense

Anyone who "unduly" (indebidamente) intercepts, interferes with, or listens to a telephone conversation faces 5 to 10 years in prison.

The qualifier "indebidamente" is critical. A participant in the conversation is not acting unduly when they record what is said to them. The prohibition covers third parties who tap into or monitor calls they have no part in.

Aggravated Penalties

The penalty rises to 10 to 15 years under any of the following circumstances:

• Public official. When the perpetrator is a public official or government employee, in or outside their official capacity. Disqualification from public office under Article 36 is imposed as an additional penalty.
• Classified information. When the intercepted communication involves information designated secret, reserved, or confidential under Ley 27806 (Transparency and Access to Public Information Law).
• National security. When the offense compromises national defense, national security, or state sovereignty.

Organized Crime Enhancement

When the offense is committed as a member of an organized criminal group, the maximum penalty is increased by up to one-third above the applicable sentencing range.

Codigo Penal Art. 162-A: Illegal Interception Equipment

Article 162-A criminalizes the manufacture, acquisition, importation, possession, or commercialization of equipment or software designed for illegal interception of communications.

Penalty. This offense carries 10 to 15 years in prison, notably higher than the base penalty for the interception itself. The legislature's intent is to cut off the supply chain for surveillance tools at the source.

Codigo Penal Art. 162-B: Electronic Communications Interception

Article 162-B was added by Decreto Legislativo No. 1234, published September 26, 2015, and extends the Art. 162 framework to modern digital channels.

Base offense. Anyone who unduly intercepts or interferes with electronic communications, instant messaging, or similar platforms faces 5 to 10 years in prison. This covers email, WhatsApp, Telegram, social media direct messages, video calls, and equivalent services.

Aggravated penalties. The same three aggravating factors from Art. 162 apply, raising the penalty to 10 to 15 years: public official status, classified information, and national security implications.

Organized crime enhancement. Up to one-third above the applicable maximum.

The same "indebidamente" qualifier applies. A participant in an electronic communication does not violate Art. 162-B by recording or preserving that communication.

The Risk Doctrine: Why Participant Recording Is Lawful

Peru's one-party consent standard rests on the doctrina del riesgo (risk doctrine), affirmed and refined through a line of Supreme Court and Constitutional Court decisions.

Core Principle

The risk doctrine holds that when a person voluntarily participates in a conversation, they assume the inherent risk that the other participant may record or later disclose what was said. The other participant already possesses the content of the conversation because they heard it firsthand. Recording simply preserves what they already know. The constitutional and penal provisions protecting communication secrecy target outside interference, not the acts of someone who is inside the communication.

Tribunal Constitucional, Case 00867-2011-AA

This Constitutional Court ruling addressed a habeas corpus petition challenging the admissibility of participant recordings in a criminal case. The plaintiff argued that recordings made by the other party to the calls violated his constitutional right to communication secrecy.

The court rejected the challenge. It held that the right to the inviolability of communications does not extend to a situation where one of the parties to the communication records it. The protective scope of Article 2, Clause 10 is designed to prevent outside intrusion. It does not prohibit a participant from preserving their own side of a conversation. This ruling is the foundational Constitutional Court precedent for the risk doctrine in Peru.

Corte Suprema, Apelacion 7-2023 (Caso Mamanivideos)

In this landmark Supreme Court decision, the court addressed whether video and audio recordings made by a conversation participant and submitted to the Fiscalia (Prosecutor's Office) constituted lawful evidence.

The court held that they did. A participant's recordings do not violate the right to intimacy or the secrecy of communications. The court applied the risk doctrine: individuals who participate in conversations assume the risk that the other party may record the exchange. The recordings were admissible evidence because they came from a direct participant, not a third-party eavesdropper.

Corte Suprema, Apelacion 221-2024 (San Martin)

In this 2024 ruling, the Supreme Court reaffirmed the Mamanivideos holding. The court stated that when one participant records a conversation without the other party's authorization, the recording does not constitute a violation of the right to privacy or the secrecy of communications.

Together, these three decisions establish a consistent and binding line of authority: participant recording is lawful in Peru. Third-party interception is a serious crime.

Ley 29733 and the ANPD: Personal Data Protection

Ley 29733, enacted on July 3, 2011, is Peru's comprehensive personal data protection statute. It established the Autoridad Nacional de Proteccion de Datos Personales (ANPD) as the supervisory authority within the Ministry of Justice.

Key Principles

The law establishes six core principles governing any processing of personal data:

1. Legality. Personal data may only be processed if a legal basis exists.
2. Consent. Processing requires the data subject's prior, free, and informed consent, unless another legal basis applies.
3. Purpose limitation. Data may be collected and used only for a specific, explicit, and legitimate purpose.
4. Proportionality. Only data that is adequate and relevant to the stated purpose may be collected.
5. Security. Appropriate technical and organizational measures must protect data from unauthorized access, loss, or disclosure.
6. Accuracy. Data must be kept accurate and up to date.

What Counts as Personal Data

Voice recordings, video footage, and any other data that can identify a person directly or indirectly constitutes personal data under Ley 29733. This means recordings of telephone calls, workplace surveillance footage, and audio captured during meetings are all subject to the law's requirements when they involve identifiable individuals.

Sensitive Data Categories

The law identifies specific categories of sensitive personal data requiring heightened protection: racial or ethnic origin, economic status, political opinions, religious or philosophical beliefs, union membership, health and medical information, sexual life data, and biometric data. Processing sensitive data requires explicit written consent or a specific statutory authorization.

Data Subject Rights

Individuals have the right to access their personal data held by any organization, to correct inaccurate data, to delete data no longer needed for its stated purpose, and to object to certain forms of processing. These rights apply to recordings in which the individual is identifiable.

Cross-Border Data Transfers

Transfers of personal data to countries outside Peru are permitted only when the destination country offers a level of personal data protection at least equivalent to that provided by Ley 29733. Where equivalent protection cannot be established, transfers require explicit consent from the data subject or approved contractual mechanisms.

Decreto Supremo 016-2024-JUS: The 2025 Regulation

On November 30, 2024, the Peruvian government published Decreto Supremo 016-2024-JUS, a comprehensive new regulation implementing Ley 29733. The new regulation took effect on March 31, 2025, replacing the 2013 regulation (DS 003-2013-JUS) in its entirety.

Key changes include:

• Advertising calls. Companies must obtain prior explicit consent before making commercial prospecting calls. An initial contact to request consent is permitted, but only if the source of the contact information was lawful. Using data from unlawful sources triggers fines of 50 to 100 UIT.
• Consent mechanics. The regulation clarifies what constitutes valid, freely given, specific, informed consent, including requirements for withdrawal mechanisms.
• AI and profiling. The regulation addresses automated decision-making and profiling, requiring transparency and the right to human review.
• International transfers. Updated rules establish what counts as adequate protection in the receiving country and what contractual safeguards may substitute for adequacy.
• Sanctions. The maximum administrative fine for serious violations reaches 100 UIT (Unidad Impositiva Tributaria).

The ANPD has enforcement powers including the authority to audit data processing activities, impose fines, and order the suspension of processing.

Ley 27697: Court-Ordered Interception

Ley 27697, enacted in 2002, governs when the government may lawfully intercept private communications during criminal investigations. It implements the constitutional exception that permits judicial authorization for surveillance in defined circumstances.

Qualifying Crimes

Court-ordered interception is limited to investigations involving:

• Kidnapping (secuestro)
• Human trafficking (trata de personas)
• Child pornography (pornografia infantil)
• Aggravated robbery (robo agravado)
• Extortion (extorsion)
• Illicit drug trafficking (trafico ilicito de drogas)
• Illicit migrant trafficking (trafico ilicito de migrantes)
• Crimes against humanity (delitos contra la humanidad)
• Attacks on national security and treason
• Embezzlement (peculado)
• Corruption of officials (corrupcion de funcionarios)
• Terrorism (terrorismo)
• Tax and customs crimes
• Money laundering (lavado de activos)
• Computer crimes (delitos informaticos)

Authorization Process

1. The Fiscal (prosecutor) petitions the court, presenting evidence that interception is necessary.
2. The judge reviews the request and, if satisfied, issues a written, motivated resolution authorizing the measure.
3. The interception is carried out without the target's knowledge.
4. Initial authorization for communication interception is 60 days, extendable through successive judicial orders.

Upon receiving judicial authorization, telecom companies must provide real-time access to targeted communications using their own technicians and facilities. Companies may not notify the target individual about the interception without express authorization from the prosecutor.

Penalties for Illegal Recording: Summary Table

Civil Liability: Civil Code Articles 14 Through 17

Peru's Codigo Civil (Legislative Decree 295, 1984) establishes personality rights that provide civil remedies for privacy and image violations independently of any criminal proceedings.

Article 14 protects the right to one's own image and voice. A person's image and voice may not be used or published without their consent. The right survives death and passes to the surviving heirs.

Article 15 states that the image and voice of a person may be used for informational purposes, scientific or cultural purposes, or in connection with events of public interest even without consent, provided the use does not damage the person's honor or reputation. This carveout covers news reporting, documentaries, and public records. Public figures in their public roles have a reduced expectation of consent.

Article 16 extends protection to correspondence and private documents. Private correspondence and private papers may not be disclosed without the consent of the author. After the author's death, the surviving heirs hold this consent right.

Article 17 provides the enforcement mechanism. The person whose image, voice, correspondence, or private documents have been used or disclosed without lawful basis may demand that the use cease, that the effects of the violation be remediated, and that full civil damages be paid. These civil remedies are available in addition to, and independently of, any criminal prosecution.

Together, Arts. 14 through 17 mean that a recording that was lawfully made by a participant may still create civil liability if it is later published or disclosed in a way that violates the recorded person's image rights or reveals private information without a legitimate justification.

Recording Phone Calls in Peru

A participant in a telephone call may record the conversation without informing the other party. The recording is lawful because the person doing the recording is a party to the communication. Under the risk doctrine, the other party assumed the risk of being recorded when they chose to participate.

This applies to landline calls, mobile calls, VoIP calls (WhatsApp, FaceTime, Zoom, Google Meet), and calls through any internet-based service.

A third party who taps into, intercepts, or monitors a phone call without being a participant commits a criminal offense under Art. 162 (telephone) or Art. 162-B (electronic communications), facing 5 to 10 years in prison.

Recording In-Person Conversations

The one-party consent framework applies equally to face-to-face conversations. A person physically present and participating in a conversation may record it without notifying the other participants.

If someone places a hidden recording device in a room to capture a conversation between people they are not part of, that constitutes a violation of intimacy under Art. 154 and, depending on the method and communication type, may also invoke Art. 161 or Art. 162.

Public spaces. In public spaces, individuals have a reduced expectation of privacy. Recording events, protests, public speeches, and other publicly occurring activities is generally permitted. Being in a public space does not eliminate all privacy protections. Recording a specific individual in public with intent to harass, defame, or cause harm may still constitute a separate offense depending on purpose and context.

Recording Police (PNP) and Public Officials

Peru has no statute expressly granting citizens the right to record police officers. However, the legal framework strongly supports the practice. Public officials exercising their official duties in public have a diminished expectation of privacy with respect to their professional conduct.

Ley 27806 (Transparency and Access to Public Information Law) establishes a broad presumption of openness for government activities. Recording police officers, prosecutors, or other officials acting in their official capacity in a public space is consistent with this transparency framework.

Citizens recording public officials should bear in mind that recording in a public space is generally lawful, but obstructing official duties while recording may create separate liability. A genuine unedited recording is not affected by Ley 32314's deepfake provisions.

Workplace Recording in Peru

Workplace recording in Peru requires attention to criminal law, labor law, and data protection.

Employer Video Surveillance

The Tribunal Constitucional held in Sentencia 599/2020 that employers may install video surveillance cameras in the workplace without requiring prior employee consent, provided the cameras serve legitimate security or operational purposes.

Cameras may be placed in work areas, production floors, hallways, and access points. They may not be placed in restrooms, changing rooms, break rooms, cafeterias, or other areas where employees have a reasonable expectation of personal privacy. Surveillance must serve a general business purpose and must not single out a specific employee without lawful justification.

Audio Recording in the Workplace

An employee who participates in a workplace conversation may record it without informing the other participants. An employer who participates in a meeting or call may likewise record it. Installing hidden audio recording devices to capture conversations between employees that the employer does not participate in raises serious concerns under Art. 154 (violation of intimacy) and potentially Art. 162 or Art. 162-B depending on the communication channel.

Data Protection Obligations for Employers

Under Ley 29733 as updated by DS 016-2024-JUS, voice recordings and video surveillance footage that captures identifiable individuals constitute personal data. Employers must inform employees about the existence and purpose of surveillance systems, process collected data only for the stated purpose, define and enforce data retention periods, comply with data subject access requests, and maintain appropriate technical security for stored recordings.

Non-Consensual Intimate Images (NCII)

Article 154-B of the Penal Code addresses non-consensual intimate image (NCII) abuse.

Elements of the offense. The provision requires: (1) intentional distribution, threat of distribution, or making accessible; (2) images, audiovisual material, or audio with sexual content; (3) depicting a person who has not consented; (4) with whom the offender had or maintains an intimate or trust relationship.

Penalty. Three to six years in prison.

Public prosecution. NCII cases under Art. 154-B are pursued publicly by the Ministerio Publico, unlike the private-action Art. 154 offense.

The offense applies regardless of whether the images were originally created with consent. If a person initially consented to the recording but did not consent to its distribution, distributing the material still falls under Art. 154-B.

Deepfakes and AI: Ley 31814 and Ley 32314

Peru is one of the first Latin American countries to directly legislate the criminal use of artificial intelligence in the context of recording, privacy, and related offenses.

Ley 31814: AI Promotion Law (July 2023)

Ley 31814, published on July 5, 2023, promotes the development and use of artificial intelligence for Peru's economic and social advancement while requiring that AI systems respect human rights and are used ethically. The law establishes principles of safety, transparency, sustainability, and human dignity that apply to all AI applications.

The implementing regulation, approved by Decreto Supremo No. 115-2025-PCM and published on September 9, 2025, defines AI risk levels and imposes specific obligations on both public and private entities. Organizations deploying high-risk AI systems must conduct risk assessments, maintain transparency documentation, and allow human oversight of automated decisions that affect individuals. Public entities must also publish the source code of AI systems developed with public funds.

Ley 32314: AI as a Criminal Aggravating Factor (April 2025)

Ley 32314, published in the Diario Oficial El Peruano on April 28, 2025, directly amends the Penal Code and the Cybercrime Law to address the criminal use of artificial intelligence. The law was passed with 99 votes in favor.

General aggravating factor. Article 46 of the Penal Code was amended to list the use of AI or analogous technologies as a general aggravating circumstance for the commission of any criminal offense.

Defamation. When defamation is committed through AI-generated content, deepfakes, or other AI-assisted material that spreads false or denigrating information to damage a person's reputation or image, the penalty is 1 to 3 years in prison.

Fraud. AI-assisted fraud, including manipulation of voice, image, audio, or body movement of a third party through deepfake technology in a way that causes economic harm, is treated as aggravated fraud with enhanced penalties.

Child sexual abuse material (CSAM). Possessing, promoting, manufacturing, distributing, or manipulating images, videos, or audio of a sexual nature involving minors using AI or deepfake technology carries 6 to 10 years in prison.

NCII with AI. When non-consensual intimate images are fabricated or manipulated using AI or deepfake technology, this is treated as an aggravated form of the Art. 154-B offense.

Practical significance. Ley 32314 does not affect the lawfulness of genuine participant recordings. It targets the fabrication or manipulation of audio and video using AI to deceive, defame, coerce, or exploit. A person who records their own actual conversation remains protected by the one-party consent framework.

Cross-Border Recording Considerations

When a Peru-based participant records a call with a person in another country, Peruvian law governs the conduct of the Peruvian party. The laws of the other party's country may independently apply to their side of the recording.

United States. Most US states are one-party consent states at the federal and state level, aligning with Peru's framework. A handful of US states require all-party consent; if the call partner is in one of those states, their local law may impose an obligation that the Peruvian law does not.

European Union. EU-based participants in calls with Peru-based individuals may be protected by GDPR. If an organization in Peru processes personal data about EU residents, it may be subject to GDPR obligations regardless of where the processing occurs. Peru is not an EU-recognized adequate country, so additional safeguards are required for cross-border transfers of EU resident data.

Latin America. Brazil, Argentina, Chile, Colombia, and Mexico each have their own recording consent frameworks. Some require all-party consent. Businesses and individuals regularly communicating across these borders should verify the applicable rules in each jurisdiction.

Data transfers out of Peru. Under Ley 29733 as updated by DS 016-2024-JUS, transfers of personal data from Peru to a country without equivalent protection require explicit data subject consent or approved contractual mechanisms. Organizations that store recordings on servers outside Peru should assess whether the destination country meets Peru's adequacy standard.

Disclosure and Distribution Rules

Recording a conversation as a participant is lawful. What happens to that recording afterward is governed by a separate set of rules.

Civil Code Art. 16 and Art. 17. Publishing or disclosing a recording that reveals another person's private information without their consent and without a legitimate justification can create civil liability for damages. The recorded person may seek an injunction, correction, and financial compensation.

Penal Code Art. 154 (aggravated). Revealing intimate information obtained through observation, listening, or recording carries 1 to 3 years in prison. Distributing through social media raises this to 2 to 4 years.

Evidentiary use. A participant's recording may be submitted as evidence in civil, criminal, labor, or administrative proceedings. The Corte Suprema confirmed this in Apelacion 7-2023 and Apelacion 221-2024. Courts assess the recording's authenticity and chain of custody. An unedited, verified recording by a participant is generally admissible.

Business Compliance Guidelines

Organizations operating in Peru that record communications should implement the following practices.

Identify the legal basis. Determine whether recordings are made by a conversation participant (lawful under one-party consent) or through third-party monitoring (requiring specific legal authority). Document this determination for each recording use case.

Provide notice for systematic recording. While one-party consent allows participant recording without advance notice, businesses that systematically record customer calls or internal meetings should provide notice as a best practice. Notice supports compliance with Ley 29733's transparency requirements and reduces legal exposure.

Register data processing activities. Under Ley 29733 and DS 016-2024-JUS, organizations that process personal data including voice recordings must maintain a registry of processing activities and, in some cases, notify the ANPD.

Restrict surveillance to appropriate areas. Video and audio surveillance must not extend to restrooms, changing rooms, break areas, or other spaces where employees have a reasonable personal privacy expectation.

Limit retention. Define how long recordings are kept and delete them once the stated purpose has been fulfilled. Indefinite retention of personal data violates the proportionality principle under Ley 29733.

Address AI use. If AI systems are used to process, transcribe, analyze, or generate content from recordings, Ley 31814 and DS 115-2025-PCM impose transparency, risk assessment, and human oversight obligations. Ley 32314 prohibits using AI to fabricate or manipulate recorded content in ways that harm individuals.

Maintain recording integrity. If recordings may be used as evidence, preserve the original file without alteration. Document the chain of custody from the moment of recording.