Urgent Decree N. 007-2020 - Digital Trust Framework
Peru · Regulation · Presidency of the Council of Ministers
Our summary
This urgent decree establishes measures to ensure confidence among people when using digital services provided by public entities and private sector organizations in Peru. It creates a framework for digital trust across the country.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
19 sections
Jump to a chapter
Capítulo I General Provisions
3 sections
This chapter sets out the foundational provisions of the framework, including its purpose, scope and key terminology related to digital trust and the digital environment.
Artículo 1 Purpose
The decree aims to establish necessary measures to ensure that people can trust their interactions with digital services provided by both public entities and private sector organizations within Peru.
Artículo 2 Scope
The digital trust rules and procedures apply to public entities under Peru's general administrative procedure law, as well as civil society organizations, citizens, businesses and academia.
Artículo 3 Definitions
The section defines digital trust as the state resulting from truthful, predictable, ethical, proactive, transparent, secure, inclusive and reliable interactions in digital environments covering data protection, ethics, transparency, digital security and consumer protection, and defines related terms: digital economy, digital environment, critical activities, digital security incidents and incident management, and digital security risk. Cybersecurity is defined as the technological capacity to preserve proper functioning of networks, assets and information systems while protecting them against threats and vulnerabilities, representing the technical perspective of digital security. Digital service means service provided totally or partially through Internet or equivalent networks, partially or fully automated, using digital technologies and data intensively, allowing acquiring goods or services, searching and sharing data or information, paying for services or goods, or interaction between persons; digital service provider means any public entity or private sector organization, regardless of location, responsible for design, provision or access to digital services in national territory.
Capítulo II Digital Trust Framework
4 sections
This chapter establishes the framework for digital trust, designating the governing body responsible for it, outlining that body's powers and establishing the National Center for Digital Security as a key institutional mechanism.
Artículo 4 Digital Trust Framework
The framework comprises principles, models, policies, norms, processes, technologies and minimum standards to ensure trust in the digital environment, with three sectors: personal data protection and transparency overseen by the Justice Ministry, consumer protection overseen by INDECOPI, and digital security overseen by the Prime Minister's Office through its Digital Government Secretariat.
Artículo 5 Governing Body for Digital Trust
The Prime Minister's Office, acting through the Digital Government Secretariat, serves as the governing authority responsible for coordinating all aspects of digital trust policy.
Artículo 6 Powers of the Governing Body
The governing body must formulate and direct the national digital trust strategy, issue guidelines and standards, assess the needs of public and private entities, coordinate implementation across sectors, and keep leadership informed of progress and security incidents.
Artículo 7 National Center for Digital Security
The center is a digital platform under the Prime Minister's Office that manages, directs and supervises digital security operations nationally; serves as the sole point of contact for communications with similar domestic and international bodies; incorporates a national incident response team responsible for managing responses to incidents and coordinating with other teams; and the Digital Government Secretariat establishes escalation protocols and issues relevant guidelines.
Capítulo III Measures to Strengthen Digital Trust
3 sections
This chapter covers measures to strengthen digital trust, including establishment of a national incident registry, international coordination and domestic coordination arrangements.
Artículo 8 National Digital Security Incidents Registry
Establishes a confidential national registry managed by the Digital Government Office to receive and consolidate data on digital security incidents reported by service providers nationwide. The National Digital Security Centre provides incident information to responsible parties under the Digital Security and Trust frameworks while observing data protection rules.
Artículo 10 International coordination
The Digital Government Office coordinates with the Foreign Ministry on international actions that strengthen confidence in the digital environment within their respective competencies.
Artículo 11 Communications coordination
The Digital Government Office coordinates with the Transport and Communications Ministry on communications matters within their respective competencies.
Capítulo IV Ethical use of digital technologies and data
5 sections
This chapter covers obligations of digital service providers, data as strategic assets, the National Data Centre, financing, and endorsement of measures for ethical technology and data use.
Artículo 9 Obligations of digital service providers
Public sector entities, digital service providers in finance, basic services, health, transport, internet, critical activities and education must comply with specified security and data handling obligations under this regulation.
Artículo 12 Data as strategic assets
Both public and private entities must manage personal, biometric and spatial data as strategic assets ensuring ethical use, transparency and strict compliance with data protection regulations. Entities promote ethical use of digital technologies including artificial intelligence and large-scale data analytics, with personal data treatment governed by the data protection authority.
Artículo 13 National Data Centre
A digital platform is created under the Prime Minister's Office via the Digital Government Office to manage and supervise data operations, education and collaboration nationally. It exchanges information with public entities, academia, civil society and the private sector and establishes protocols and directives for data governance.
Artículo 14 Financing
Implementation costs are financed through each involved entity's institutional budget without requiring additional public funds.
Artículo 15 Endorsement and final complementary provisions
The Executive Branch shall approve implementing regulations within ninety business days through Decree endorsed by the Prime Minister. The Prime Minister's Office must establish a National Registry of Digital Security Incidents within ninety business days and issue norms and guidelines for its operation. The Office of Digital Government shall manage national networks to support national policies, digital society strengthening and state digital transformation.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 9 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Impact assessment, not covered
Data and privacy 2 of 4
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
Technical safeguards 1 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 1 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 33 are shown.
Artículo 4 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
The Justice Ministry must regulate, direct, supervise and evaluate matters of transparency and personal data protection as part of the Digital Trust Framework.
- ObligationApplies to: Public authorityDrafted by the Index
INDECOPI must regulate, direct, supervise and evaluate matters of consumer protection as part of the Digital Trust Framework.
- ObligationApplies to: Public authorityDrafted by the Index
The Prime Minister's Office through its Digital Government Secretariat must regulate, direct, supervise and evaluate digital security matters as the leading national authority.
Artículo 5 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The Prime Minister's Office, acting through the Digital Government Secretariat, serves as the governing authority responsible for coordinating all aspects of digital trust policy.
Artículo 6 5 controls
- ObligationApplies to: Public authorityDrafted by the Index
The governing body must formulate, direct and oversee the national digital trust strategy.
- ObligationApplies to: Public authorityDrafted by the Index
The governing body must issue guidelines, standards, specifications, directives and technical norms on digital trust.
- ObligationApplies to: Public authorityDrafted by the Index
The governing body must assess the digital trust needs of public entities, private organisations and individuals.
- ObligationApplies to: Public authorityDrafted by the Index
The governing body must coordinate implementation of the digital trust strategy with public sector, private sector, civil society, academia and other stakeholders.
- ObligationApplies to: Public authorityDrafted by the Index
The governing body must keep the Prime Minister informed of progress in digital trust and digital security incidents reported to the national digital security centre.
Artículo 7 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
The National Centre for Digital Security, under the Prime Minister's Office, must manage, direct and supervise digital security operations nationally and identify, protect, detect, respond and recover from digital security incidents.
- ObligationApplies to: Public authorityDrafted by the Index
The National Centre for Digital Security is the sole point of contact for communications and coordination with other national and international digital security bodies.
- ObligationApplies to: Public authorityDrafted by the Index
The National Digital Incident Response Team, incorporated in the Centre, must manage responses to digital security incidents and coordinate with other similar national and international teams.
- ObligationApplies to: Public authorityDrafted by the Index
The Digital Government Secretariat must establish escalation protocols and issue guidelines and directives for digital security incidents.
Artículo 8 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
The Digital Government Secretariat must create and maintain a confidential national registry to receive, consolidate and maintain data on digital security incidents reported by digital service providers.
- ObligationApplies to: Public authorityDrafted by the Index
The Digital Government Secretariat is responsible for ensuring the availability, confidentiality and integrity of the national digital security incidents registry.
- ObligationApplies to: Public authorityDrafted by the Index
The National Centre for Digital Security must share incident registry information with responsible parties under the digital security and trust frameworks while complying with personal data protection rules.
Artículo 10 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The Digital Government Office must coordinate with the Foreign Ministry on international actions that strengthen confidence in the digital environment within their respective competencies.
Artículo 11 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The Digital Government Office must coordinate with the Transport and Communications Ministry on communications matters within their respective competencies.
Artículo 9 1 control
- ObligationApplies to: ProviderDrafted by the Index
Public sector entities and digital service providers in finance, basic services, health, transport, internet, critical activities and education must comply with specified security and data handling obligations under this regulation.
Applies when: finance, basic services, health, transport, internet, critical activities and education sectors
Artículo 12 5 controls
- ObligationApplies to: DeployerDrafted by the Index
Public and private entities must manage personal, biometric and spatial data as strategic assets, ensuring ethical use, transparency and compliance with data protection regulations.
- ObligationApplies to: DeployerDrafted by the Index
Public and private entities must promote ethical use of digital technologies including artificial intelligence and large-scale data analytics.
- ObligationApplies to: AnyoneDrafted by the Index
Treatment of personal data must comply with legislation issued by the National Authority for Personal Data Protection.
- ObligationApplies to: AnyoneDrafted by the Index
Entities must notify the National Centre for Digital Security of all digital security incidents.
- ObligationApplies to: AnyoneDrafted by the Index
Entities must implement physical, technical, organisational and legal security measures to guarantee the confidentiality of messages, content and information transmitted through their communications services.
Artículo 13 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
A public authority must establish and operate a National Data Centre as a digital platform to manage, direct, coordinate and oversee data operations, education, promotion, collaboration and cooperation at the national level.
- ObligationApplies to: Public authorityDrafted by the Index
The National Data Centre must be placed under the Prime Minister's Office through the Digital Government Office and serve as the sole national contact point for communications and coordination with similar national and international bodies.
- ObligationApplies to: Public authorityDrafted by the Index
The National Data Centre must exchange information and coordinate actions with public entities, academia, civil society, the private sector and bodies responsible for the Digital Trust Framework.
- ObligationApplies to: Public authorityDrafted by the Index
The Digital Government Office, as the governing body for data governance, must establish protocols and mechanisms for data governance and issue corresponding guidelines and directives.
Artículo 14 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The costs of implementing this decree must be financed from the institutional budget of each involved entity without requiring additional public funds.
Artículo 15 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
The executive power must approve implementing regulations for this decree within ninety working days of its entry into force.
- ObligationApplies to: Public authorityDrafted by the Index
The Prime Minister's Office must establish and implement the National Digital Security Incidents Registry within ninety working days of this decree's publication and issue norms, guidelines and directives for its proper operation.
- ObligationApplies to: Public authorityDrafted by the Index
The Prime Minister's Office through the Digital Government Office must manage and promote the National State Network and the National Research and Education Network as referred to in Law 29904 to support national policies and digital transformation of the State.
- ObligationApplies to: AnyoneDrafted by the Index
This decree applies to public-private partnerships, concession contracts, projects included in private investment promotion processes and other digital transformation projects and platforms designed, initiated or managed from the date this decree enters into force.
Applies when: projects initiated after the decree's entry into force
Change history
No changes recorded since we began monitoring this policy.