- Asian Investment Desk
- Banking and Finance
- Banking Regulation
- Capital Markets
- Corporate and Commercial
- Corporate Compliance
- Energy
- Environmental
- ESG | Environmental, Social and Governance
- Fintech
- Fishery
- Forestry
- Immigration
- Infrastructure and Concessions
- Insurance and Reinsurance
- Intellectual Property
- International Trade and Customs
- Labor & Employment
- Life Sciences
- Maritime and Aviation
- Mergers and Acquisitions
- Mining
- Oil & Gas
- Privacy and Data Protection
- Project Development
- Project Finance
- Public Law
- Public Procurement
- Public Services Regulation
- Real Estate Investment
- Restructuring and Insolvency
- Tax
- Telecom, Media & Technology (TMT)
- Venture Capital and Entrepreneurship
- Water Resources and Sanitation
- Wealth Management
Asian Investment Desk
Banking and Finance
Banking Regulation
Capital Markets
Corporate and Commercial
Corporate Compliance
Energy
Environmental
ESG | Environmental, Social and Governance
Fintech
Fishery
Forestry
Immigration
Infrastructure and Concessions
Insurance and Reinsurance
Intellectual Property
International Trade and Customs
Labor & Employment
Life Sciences
Maritime and Aviation
Mergers and Acquisitions
Mining
Oil & Gas
Privacy and Data Protection
Project Development
Project Finance
Public Law
Public Procurement
Public Services Regulation
Real Estate Investment
Restructuring and Insolvency
Tax
Telecom, Media & Technology (TMT)
Venture Capital and Entrepreneurship
Water Resources and Sanitation
Wealth Management
Alert
Privacy and Data Protection Alert - November 2025
For more information, contact:
Themes
November 5, 2025
REGULATIONS OF THE EMERGENCY DECREE APPROVING THE DIGITAL TRUST FRAMEWORK
On November 5, 2025, Supreme Decree No. 126-2025-PCM was published, approving the Regulations of Emergency Decree No. 007-2020, which established the digital trust framework and stipulated measures for its strengthening.
The following provisions are noteworthy:
- The Regulations apply, among others, to private sector companies that provide digital services through the Internet or other equivalent networks within the national territory.
- The Regulations aim to develop the regulatory provisions to ensure that individuals' digital interactions with digital services provided within the national territory are truthful, predictable, ethical, proactive, transparent, secure, inclusive, reliable, and of high quality.
- In this regard, digital service providers (digital service providers in the financial sector, basic services (electricity, water, and gas), healthcare, and passenger transport, internet service providers, providers of critical activities, and providers of educational services delivered in the digital environment) have the following obligations, among others:
- Notify the National Center for Digital Security of digital security incidents through the established protocols, channels, and timeframes.
- Implement security controls and measures in the provision of digital services.
- Establish authentication mechanisms to verify the identity of individuals accessing a digital service, considering the levels of trust in authentication.
- Maintain a secure, scalable, and interoperable infrastructure to guarantee the confidentiality, availability, and integrity of digital services.
- Provide digital or electronic payment services with appropriate security mechanisms, where applicable.
- Proactively conduct vulnerability assessments of digital services to identify digital security risks.
- Promote digital innovation as an integral element for reducing digital security risks to an acceptable level.
The implementation of the aforementioned security measures must comply with the provisions of the Personal Data Protection Law.