Peru
Jurisdiction with LATAM's most restrictive case law: the Supreme Court requires a court order to access corporate emails. vario operates as automated signal analysis, not email opening, which distinguishes it from the case scenario.
Important notice
vario is a technical detection and monitoring tool. The information in this section is for informational purposes only and does not constitute legal advice, nor does it replace the judgment of a qualified attorney. vario does not provide legal representation services or issue legal opinions. Before implementing any monitoring program, consult a lawyer specializing in labor law and data protection in your jurisdiction.
Antitrust
Why is communications monitoring a valid antitrust compliance tool in Peru?
INDECOPI has published general guidelines for preventing competition law infringements that include internal controls as a compliance component. Law 30424 on Administrative Liability of Legal Entities introduces compliance as a mitigating factor — similar to Argentina's Law 27.401. For financial sector entities supervised by the SBS and SMV, the legal obligation of internal controls is even more explicit.
What conduct does vario detect and why is it illegal under INDECOPI?
vario detects signals of cartels (price fixing), bid manipulation (bid rigging), and strategic information exchange among competitors — all sanctioned under Legislative Decree 1034 (Law on Repression of Anticompetitive Conduct). INDECOPI has growing enforcement activity, especially in public procurement and concentrated markets.
Does antitrust compliance reduce sanctions in Peru?
Yes. Law 30424 recognizes compliance as a mitigating factor for corporate administrative liability. For financial entities under the SBS or capital markets under the SMV, communications monitoring can also be justified as compliance with the legal obligation to manage risks and prevent market abuse — a stronger legal basis than standalone consent.
How does INDECOPI compare to other LATAM regulators?
Unlike CADE (Brazil), COFECE (Mexico), and SIC (Colombia), INDECOPI has not issued specific guidelines mentioning communications monitoring as an antitrust compliance tool. Explicit regulatory endorsement is weaker than in other countries. However, general compliance principles and financial sector obligations partially offset this gap.
Privacy & data protection
Is it legal for an employer to monitor corporate email in Peru?
It is possible, but requires a specific technical and legal design. Labor Cassation N° 48825-2022 (Supreme Court, 2024) establishes that accessing the content of corporate emails requires a reasoned court order. However, vario does not "open" emails — it analyzes signals via AI in an automated manner, without human reading. This difference is the central argument: an automated compliance system operates like an antivirus (which scans emails without a court order) and not like a communications interception.
Does the Internal Work Regulation authorize monitoring in Peru?
Not by itself. Cassation N° 14614-2016 (Nestlé Perú) established that clauses in the Internal Work Regulation granting the employer ownership or unilateral access to employee emails are invalid and violate constitutional rights. Unlike Chile, Colombia, or Mexico, in Peru the Internal Work Regulation is a necessary but insufficient condition — it does not replace informed consent or eliminate the restriction from Cassation 48825-2022.
What conditions must a company meet to deploy vario in Peru?
Law 29733 requires informed, prior, express, and unequivocal consent from employees — the primary legal basis. Consent must be specific to automated signal analysis (not to "reading emails"). Designating a Data Protection Officer (DPO) is recommended if processing is intensive (Legislative Decree 1398). The privacy notice must detail the scope of automated analysis. For SBS/SMV entities, the legal obligation of internal controls can serve as a complementary legal basis.
Which data protection authority applies in Peru?
The Autoridad Nacional de Protección de Datos (ANPD), under Law 29733 (2011). The ANPD issued a Security Directive for Personal Data Processing with technical and organizational security requirements. Peru is the second LATAM country — after Brazil — with a mandatory DPO for intensive data processing, under Legislative Decree 1398.
Does corporate email have the same protection as personal email in Peru?
Yes — and this distinguishes Peru from the rest of LATAM. Art. 2, Inc. 10 of the Constitution protects "private documents" without distinguishing between corporate and personal email: both require a court order to be "opened, seized, intercepted, or intervened". Brazil (TST), Mexico (SCJN), and Chile (CADEM) do establish that distinction. This is why vario's technical positioning — automated signal analysis, not email opening — is especially critical in Peru.
Start protecting your communications
Tell us about your organization and a member of the vario team will show you how it works.
Talk to the teamNo commitment · The vario team will get back to you soon